{"id":"CVE-2026-12706","aliases":["DEBIAN-CVE-2026-12706","EUVD-2026-38004","GHSA-qh4m-69pj-9vc2","OESA-2026-2826","OESA-2026-2827","OESA-2026-2828","OESA-2026-2829","SUSE-SU-2026:3529-1","SUSE-SU-2026:3542-1","UBUNTU-CVE-2026-12706","USN-8750-1","openSUSE-SU-2026:11347-1","openSUSE-SU-2026:11360-1","openSUSE-SU-2026:11361-1","openSUSE-SU-2026:11515-1","openSUSE-SU-2026:21877-1"],"status":"published","title":"Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00454,"percentile":0.39846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-06-19T10:55:03Z","modified":"2026-10-17T12:58:04Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.9-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.4-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:8.1.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","fixed_in":["6.1.1-33.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","fixed_in":["6.1.1-33.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm17"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","fixed_in":["7:4.4.2-0ubuntu0.22.04.1+esm16"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","fixed_in":["7.1.4-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.9-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1","7:5.1.7-0+deb12u1","7:5.1.8-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.4-0+deb13u1"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.1.1-1"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-39.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-33.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-33.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-39.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm17"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm16"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12","7:6.1.1-3ubuntu5+esm13","7:6.1.1-3ubuntu5+esm15"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4","7:7.1.1-1ubuntu4.1","7:7.1.1-1ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm17"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm16"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12706","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490710","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/"},{"url":"https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","tags":["advisory"]},{"url":"https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX"},{"url":"https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e"},{"url":"https://github.com/advisories/GHSA-qh4m-69pj-9vc2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12706","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2827","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2828","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2829","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269490","tags":["report"]},{"url":"https://bugzilla.suse.com/1272752","tags":["report"]},{"url":"https://bugzilla.suse.com/1272754","tags":["report"]},{"url":"https://bugzilla.suse.com/1272758","tags":["report"]},{"url":"https://bugzilla.suse.com/1272765","tags":["report"]},{"url":"https://bugzilla.suse.com/1272768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8461","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263542-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12706","tags":["report"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22992","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8750-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-30999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70631","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30997","tags":["web"]},{"url":"https://bugzilla.suse.com/1220546","tags":["report"]},{"url":"https://bugzilla.suse.com/1220549","tags":["report"]},{"url":"https://bugzilla.suse.com/1234017","tags":["report"]},{"url":"https://bugzilla.suse.com/1234029","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://bugzilla.suse.com/1269550","tags":["report"]},{"url":"https://bugzilla.suse.com/1272755","tags":["report"]},{"url":"https://bugzilla.suse.com/1272757","tags":["report"]},{"url":"https://bugzilla.suse.com/1272759","tags":["report"]},{"url":"https://bugzilla.suse.com/1272760","tags":["report"]},{"url":"https://bugzilla.suse.com/1272761","tags":["report"]},{"url":"https://bugzilla.suse.com/1272762","tags":["report"]},{"url":"https://bugzilla.suse.com/1272763","tags":["report"]},{"url":"https://bugzilla.suse.com/1272764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274268","tags":["report"]},{"url":"https://bugzilla.suse.com/1274270","tags":["report"]},{"url":"https://bugzilla.suse.com/1274282","tags":["report"]},{"url":"https://bugzilla.suse.com/1274287","tags":["report"]},{"url":"https://bugzilla.suse.com/1274289","tags":["report"]},{"url":"https://bugzilla.suse.com/1276407","tags":["report"]},{"url":"https://bugzilla.suse.com/1276408","tags":["report"]},{"url":"https://bugzilla.suse.com/1276409","tags":["report"]},{"url":"https://bugzilla.suse.com/1276410","tags":["report"]},{"url":"https://bugzilla.suse.com/1276412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-12706","title":"Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T10:55:03.634Z","modified":"2026-06-22T19:28:06.45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-38004","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T10:55:03Z","modified":"2026-06-22T19:28:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:33.850201Z"}],"ghsa":[{"id":"GHSA-qh4m-69pj-9vc2","title":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move()...","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T12:30:28Z","modified":"2026-06-19T12:30:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:08:54.452189Z"}],"nvd":[{"id":"CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T12:16:27.1Z","modified":"2026-06-22T20:16:28.617Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"DEBIAN-CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T12:16:27.1Z","modified":"2026-10-01T03:01:52.611814276Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"OESA-2026-2826","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.439044123Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2827","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:14.571285134Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2828","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:13.697954725Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2829","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:14.576968242Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).","status":"published","published":"2026-06-19T12:16:00Z","modified":"2026-10-17T12:58:04.945551951Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"openSUSE-SU-2026:11347-1","title":"ffmpeg-8-8.1.2-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-8-8.1.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:05.024428361Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11360-1","title":"ffmpeg-4-4.4.8-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-24T00:00:00Z","modified":"2026-07-25T18:24:56.582432863Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11361-1","title":"ffmpeg-7-7.1.4-5.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.4-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-24T00:00:00Z","modified":"2026-07-25T18:24:27.463065875Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11515-1","title":"ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media","description":"These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.658519358Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21877-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).\n- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).\n- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\n  h_subpel_filters_outer (bsc#1234029).\n- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if\n  video encoding parameters were being exported, as the side data would be attached in the decoder thread while\n  (bsc#1234017).\n- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c\n  (bsc#1237382).\n- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).\n- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n\nChanges for ffmpeg-7:\n\nUpdate to version 7.1.5:\n * Various crash, out-of-bounds access, add boundary check\n fixes. Affected: .mov parser, DASH parser, Snow encoder,\n Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech,\n ADPCM, Matroska decoder\n * avcodec/jpeg2000dec: clear array length when freeing it\n (CVE-2025-22921, bsc#1237382)\n * avcodec/magicyuv: Fix 1 line MEDIAN slices\n (CVE-2026-8461, bsc#1269490)\n * avcodec/magicyuv: reject slice_height misaligned with chroma vshift.\n * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check.\n * avcodec/rasc: fix heap use-after-free in decode_move().\n (CVE-2026-12706, bsc#1268595)\n * avformat/hls: Be more picky on extensions.\n (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)\n * lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is\n calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so\n a thread for vp9 decoding might get stuck.\n (CVE-2024-36615, bsc#1234017).\n * avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585)\n (CVE-2024-36615, bsc#1234017)\n * lavc/vp9: Fix regression introduced in 0ba0585.\n * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and\n h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6.\n (CVE-2024-35367, bsc#1234029)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.629800263Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:3529-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nUpdate to release 4.4.8.\n  \n- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution\n  (bsc#1269490).\n- CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).\n- CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution\n  (bsc#1272752).\n- CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption\n  (bsc#1272754).\n- CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory\n  corruption (bsc#1272758).\n- CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information\n  disclosure (bsc#1272768).\n- CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code\n  execution (bsc#1272765).\n\nOther updates and bugfixes:\n\n- Release 4.4.8\n  * Various bug fixes to codecs\n  * avcodec/magicyuv: Fix 1 line MEDIAN slices \n  * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check\n  * avcodec/magicyuv: reject slice_height misaligned with chroma vshift\n","status":"published","published":"2026-08-07T14:23:26Z","modified":"2026-08-08T09:00:06.081949067Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3542-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nUpdate to release 4.4.8.\n  \n- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution\n  (bsc#1269490).\n- CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).\n- CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution\n  (bsc#1272752).\n- CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption\n  (bsc#1272754).\n- CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory\n  corruption (bsc#1272758).\n- CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information\n  disclosure (bsc#1272768).\n- CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code\n  execution (bsc#1272765).\n\nOther updates and bugfixes:\n\n- Release 4.4.8\n  * Various bug fixes to codecs\n  * avcodec/magicyuv: Fix 1 line MEDIAN slices\n  * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check\n  * avcodec/magicyuv: reject slice_height misaligned with chroma vshift\n","status":"published","published":"2026-08-10T12:50:29Z","modified":"2026-08-11T09:15:06.860379097Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8750-1","title":"ffmpeg vulnerabilities","description":"Seung Min Shin discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could cause a denial of\nservice. (CVE-2026-12706)\n\nXinghang Lv discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could cause a denial of\nservice. (CVE-2026-30999)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. If a user or automated system were tricked into opening a\nspecially crafted file, an attacker could cause a denial of service.\n(CVE-2026-58049)\n\nAdrian Junge discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could leak sensitive\ninformation. (CVE-2026-70629, CVE-2026-70630, CVE-2026-70631)\n\nOri Hollander discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could possibly cause a\ndenial of service or execute arbitrary code. (CVE-2026-8461)","status":"published","published":"2026-09-14T03:25:59Z","modified":"2026-09-14T11:27:31.568391815Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}