CVE-2026-70631

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.(CVE-2026-65703)

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.(CVE-2026-65705)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.(CVE-2026-70632)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.(CVE-2026-70632)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.(CVE-2026-65703)

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.(CVE-2026-65705)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.(CVE-2026-18393)

A flaw was found in FFmpeg. An integer overflow in the libavfilter/vf_scale.c component allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing.(CVE-2026-38343)

A flaw was found in FFmpeg. This vulnerability involves a NULL pointer dereference within the get_min_buffer_size function when processing specially crafted video files. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service (DoS). A Denial of Service attack prevents legitimate users from accessing a service or resource.(CVE-2026-38344)

A flaw was found in FFmpeg. An integer overflow vulnerability in the yuv2planeX_8_c() function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing, impacting system availability.(CVE-2026-38346)

A flaw was found in FFmpeg. A heap overflow vulnerability exists in the ff_sws_alphablendaway function. This flaw allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input. Successful exploitation could lead to the application becoming unresponsive or crashing.(CVE-2026-38347)

A flaw was found in FFmpeg, specifically within the libswscale/utils.c component. An integer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This could lead to the application becoming unresponsive or crashing.(CVE-2026-38348)

A flaw was found in FFmpeg. An integer overflow vulnerability in the hScale16To19_c() function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This can lead to the application becoming unresponsive or crashing, preventing legitimate users from accessing the service.(CVE-2026-38349)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD)…

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049) Heap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830) Double-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832) Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833) Infinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834) Out-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835) Out-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703) Out-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704) vf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705) vf_swaprect Out-of-Bounds Write via NV12 Frame Processing. (CVE-2026-65706) Heap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036) IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu(). (CVE-2026-66037) LCL/ZLIB Video Decoder Information Disclosure via lcldec.c. (CVE-2026-66038) MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File. (CVE-2026-66039) Heap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041) DVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628) Uninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629) Uninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630) Uninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631) Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing. (CVE-2026-70632) Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing. (CVE-2026-75141) Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142) Heap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143) Heap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144) Out-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-7-7.1.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-8-8.1.2-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ffmpeg-4-4.4.8-5.1 package on the GA media of openSUSE Tumbleweed.

This update for ffmpeg-7 fixes the following issues:

• CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
• CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
• CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (bsc#1234029).
• CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while (bsc#1234017).
• CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382).
• CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).
• CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).
• CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption (bsc#1269550).
• CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).
• CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).
• CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).
• CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).
• CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
• CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).
• CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
• CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).
• CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
• CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
• CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
• CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
• CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
• CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
• CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
• CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).
• CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
• CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).

Changes for ffmpeg-7:

Update to version 7.1.5:

• Various crash, out-of-bounds access, add boundary check fixes. Affected: .mov parser, DASH parser, Snow encoder, Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech, ADPCM, Matroska decoder
• avcodec/jpeg2000dec: clear array length when freeing it (CVE-2025-22921, bsc#1237382)
• avcodec/magicyuv: Fix 1 line MEDIAN slices (CVE-2026-8461, bsc#1269490)
• avcodec/magicyuv: reject slice_height misaligned with chroma vshift.
• avcodec/magicyuv: Expand the s->interlaced slice-height sanity check.
• avcodec/rasc: fix heap use-after-free in decode_move(). (CVE-2026-12706, bsc#1268595)
• avformat/hls: Be more picky on extensions. (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)
• lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so a thread for vp9 decoding might get stuck. (CVE-2024-36615, bsc#1234017).
• avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585) (CVE-2024-36615, bsc#1234017)
• lavc/vp9: Fix regression introduced in 0ba0585. *…

This update for ffmpeg-4 fixes the following issues:

• CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption (bsc#1269550).
• CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).
• CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).
• CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).
• CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).
• CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
• CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).
• CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
• CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
• CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
• CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
• CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
• CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
• CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
• CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).
• CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
• CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).

This update for ffmpeg-4 fixes the following issues:

• CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption (bsc#1269550).
• CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).
• CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).
• CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).
• CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).
• CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
• CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).
• CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
• CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
• CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
• CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
• CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
• CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
• CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
• CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).
• CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
• CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).

Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-12706)

Xinghang Lv discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-30999)

It was discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-58049)

Adrian Junge discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could leak sensitive information. (CVE-2026-70629, CVE-2026-70630, CVE-2026-70631)

Ori Hollander discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly cause a denial of service or execute arbitrary code. (CVE-2026-8461)