CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata...
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
CVE-2026-52296- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-77125
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
EUVD-2026-77125- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-923g-f8rq-pv4w
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata...
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
GHSA-923g-f8rq-pv4w- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
CVE-2026-52296- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
CVE-2026-52296- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
DEBIAN-CVE-2026-52296- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2026-4144
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4145
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4145- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4146
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4146- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4147
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4147- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- Record
UBUNTU-CVE-2026-52296- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12416-1 No score
ffmpeg-8-8.1.3-4.1 on GA media
These are all security issues fixed in the ffmpeg-8-8.1.3-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12416-1- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12417-1 No score
ffmpeg-9-libavcodec-devel-9.0.2-5.1 on GA media
These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.2-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12417-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
All versions, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u17:5.1.5-0+deb12u17:5.1.6-0+deb12u1 Show 45 moreShow less7:5.1.7-0+deb12u17:5.1.8-0+deb12u17:5.1.9-0+deb12u17:6.0-17:6.0-27:6.0-37:6.0-47:6.0-57:6.0-67:6.0-77:6.0-87:6.0-97:6.1-17:6.1-27:6.1-37:6.1-47:6.1-57:6.1.1-17:6.1.1-27:6.1.1-37:6.1.1-47:6.1.1-57:7.0-17:7.0.1-17:7.0.1-27:7.0.1-37:7.0.1-47:7.0.1-57:7.0.2-17:7.0.2-27:7.0.2-37:7.1-17:7.1-27:7.1-37:7.1-47:7.1.1-17:7.1.2-17:7.1.3-17:8.0-17:8.0-27:8.0.1-17:8.0.1-27:8.0.1-37:8.1-17:8.1-2 |
None known |
ffmpegDebian:13 |
before 7:7.1.5-0+deb13u1, plus listed versions 7:7.1.1-17:7.1.2-0+deb13u17:7.1.2-17:7.1.3-0+deb13u17:7.1.3-17:7.1.4-0+deb13u1 |
7:7.1.5-0+deb13u1 |
ffmpegDebian:14 |
before 7:8.1.1-1, plus listed versions 7:7.1.1-17:7.1.2-17:7.1.3-17:8.0-17:8.0-2 Show 6 moreShow less7:8.0.1-17:8.0.1-27:8.0.1-37:8.1-17:8.1-27:8.1-3 |
7:8.1.1-1 |
ffmpegopenEuler:22.03-LTS-SP4 From an advisory covering 3 CVEs |
before 4.2.4-57.oe2203sp4 | 4.2.4-57.oe2203sp4 |
ffmpegopenEuler:24.03-LTS-SP1 From an advisory covering 3 CVEs |
before 6.1.1-52.oe2403sp1 | 6.1.1-52.oe2403sp1 |
ffmpegopenEuler:24.03-LTS-SP3 From an advisory covering 3 CVEs |
before 6.1.1-52.oe2403sp3 | 6.1.1-52.oe2403sp3 |
ffmpegopenEuler:24.03-LTS-SP4 From an advisory covering 3 CVEs |
before 6.1.1-52.oe2403sp4 | 6.1.1-52.oe2403sp4 |
libavUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 |
None known |
ffmpegUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 31 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm57:2.8.17-0ubuntu0.1+esm67:2.8.17-0ubuntu0.1+esm77:2.8.17-0ubuntu0.1+esm87:2.8.17-0ubuntu0.1+esm97:2.8.17-0ubuntu0.1+esm107:2.8.17-0ubuntu0.1+esm117:2.8.17-0ubuntu0.1+esm127:2.8.17-0ubuntu0.1+esm137:2.8.17-0ubuntu0.1+esm147:2.8.17-0ubuntu0.1+esm157:2.8.17-0ubuntu0.1+esm167:2.8.17-0ubuntu0.1+esm177:2.8.17-0ubuntu0.1+esm18 |
None known |
ffmpegUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 25 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm27:3.4.11-0ubuntu0.1+esm37:3.4.11-0ubuntu0.1+esm47:3.4.11-0ubuntu0.1+esm57:3.4.11-0ubuntu0.1+esm67:3.4.11-0ubuntu0.1+esm77:3.4.11-0ubuntu0.1+esm87:3.4.11-0ubuntu0.1+esm97:3.4.11-0ubuntu0.1+esm107:3.4.11-0ubuntu0.1+esm117:3.4.11-0ubuntu0.1+esm127:3.4.11-0ubuntu0.1+esm137:3.4.11-0ubuntu0.1+esm147:3.4.11-0ubuntu0.1+esm157:3.4.11-0ubuntu0.1+esm16 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1 Show 21 moreShow less7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm27:4.2.7-0ubuntu0.1+esm37:4.2.7-0ubuntu0.1+esm47:4.2.7-0ubuntu0.1+esm57:4.2.7-0ubuntu0.1+esm67:4.2.7-0ubuntu0.1+esm77:4.2.7-0ubuntu0.1+esm87:4.2.7-0ubuntu0.1+esm97:4.2.7-0ubuntu0.1+esm107:4.2.7-0ubuntu0.1+esm117:4.2.7-0ubuntu0.1+esm127:4.2.7-0ubuntu0.1+esm137:4.2.7-0ubuntu0.1+esm147:4.2.7-0ubuntu0.1+esm157:4.2.7-0ubuntu0.1+esm167:4.2.7-0ubuntu0.1+esm177:4.2.7-0ubuntu0.1+esm18 |
None known |
ffmpegUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu3 Show 19 moreShow less7:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm27:4.4.2-0ubuntu0.22.04.1+esm37:4.4.2-0ubuntu0.22.04.1+esm47:4.4.2-0ubuntu0.22.04.1+esm57:4.4.2-0ubuntu0.22.04.1+esm67:4.4.2-0ubuntu0.22.04.1+esm77:4.4.2-0ubuntu0.22.04.1+esm87:4.4.2-0ubuntu0.22.04.1+esm97:4.4.2-0ubuntu0.22.04.1+esm107:4.4.2-0ubuntu0.22.04.1+esm117:4.4.2-0ubuntu0.22.04.1+esm127:4.4.2-0ubuntu0.22.04.1+esm137:4.4.2-0ubuntu0.22.04.1+esm147:4.4.2-0ubuntu0.22.04.1+esm157:4.4.2-0ubuntu0.22.04.1+esm167:4.4.2-0ubuntu0.22.04.1+esm17 |
None known |
ffmpegUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1 Show 17 moreShow less7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu57:6.1.1-3ubuntu5+esm17:6.1.1-3ubuntu5+esm27:6.1.1-3ubuntu5+esm37:6.1.1-3ubuntu5+esm47:6.1.1-3ubuntu5+esm57:6.1.1-3ubuntu5+esm67:6.1.1-3ubuntu5+esm77:6.1.1-3ubuntu5+esm87:6.1.1-3ubuntu5+esm107:6.1.1-3ubuntu5+esm117:6.1.1-3ubuntu5+esm127:6.1.1-3ubuntu5+esm137:6.1.1-3ubuntu5+esm15 |
None known |
ffmpegUbuntu:26.10 |
All versions, plus listed versions 7:8.0.1-3ubuntu27:8.1-3ubuntu37:8.1.2-2ubuntu2 |
None known |
ffmpegUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 7:7.1.1-1ubuntu47:7.1.2-1ubuntu37:7.1.2-1ubuntu47:7.1.3-1ubuntu17:8.0.1-2ubuntu1 Show 6 moreShow less7:8.0.1-3ubuntu17:8.0.1-3ubuntu27:8.0.1-3ubuntu2+esm17:8.0.1-3ubuntu2+esm37:8.0.1-3ubuntu2+esm47:8.0.1-3ubuntu2+esm5 |
None known |
ffmpeg-8openSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 8.1.3-4.1 | 8.1.3-4.1 |
ffmpeg-9openSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 9.0.2-5.1 | 9.0.2-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-52296 is a low vulnerability (CVSS 2.9) in Ffmpeg, published September 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in ffmpeg 7:7.1.5-0+deb13u1.
References
github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding
code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988
git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47
nvd.nist.gov/vuln/detail/CVE-2026-52296
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2026-52296
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4144
ubuntu.com/security/CVE-2026-52296
cve.org/CVERecord?id=CVE-2026-52296
suse.com/security/cve/CVE-2026-38344
Left out here: 12 versions. The JSON record has them.