{"id":"CVE-2026-65706","aliases":["DEBIAN-CVE-2026-65706","EUVD-2026-48373","GHSA-g9rh-4g64-7qxg","JLSEC-2026-1181","MGASA-2026-0398","OESA-2026-3541","OESA-2026-3542","OESA-2026-3543","OESA-2026-3544","OESA-2026-3545","SUSE-SU-2026:3934-1","SUSE-SU-2026:4149-1","SUSE-SU-2026:4150-1","UBUNTU-CVE-2026-65706","USN-8716-1","USN-8716-2","openSUSE-SU-2026:11545-1","openSUSE-SU-2026:11563-1","openSUSE-SU-2026:11665-1","openSUSE-SU-2026:11682-1","openSUSE-SU-2026:21877-1"],"status":"published","title":"FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00187,"percentile":0.08371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-131","CWE-787"],"published":"2026-07-23T19:05:11Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:9.0.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_nogpl_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","fixed_in":["7:3.4.11-0ubuntu0.1+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","fixed_in":["7:4.4.2-0ubuntu0.22.04.1+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","fixed_in":["7:6.1.1-3ubuntu5+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","fixed_in":["7:8.0.1-3ubuntu2+esm4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1","7:5.1.7-0+deb12u1","7:5.1.8-0+deb12u1","7:5.1.9-0+deb12u1","7:6.0-1","7:6.0-2","7:6.0-3","7:6.0-4","7:6.0-5","7:6.0-6","7:6.0-7","7:6.0-8","7:6.0-9","7:6.1-1","7:6.1-2","7:6.1-3","7:6.1-4","7:6.1-5","7:6.1.1-1","7:6.1.1-2","7:6.1.1-3","7:6.1.1-4","7:6.1.1-5","7:7.0-1","7:7.0.1-1","7:7.0.1-2","7:7.0.1-3","7:7.0.1-4","7:7.0.1-5","7:7.0.2-1","7:7.0.2-2","7:7.0.2-3","7:7.1-1","7:7.1-2","7:7.1-3","7:7.1-4","7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1","7:7.1.4-0+deb13u1","7:7.1.5-0+deb13u1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.2-1"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1"]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_nogpl_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10.tainted"}]}],"bundled":25},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-53.oe2203sp4"}]}],"bundled":14},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-47.oe2403sp1"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-47.oe2403sp3"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-47.oe2403sp4"}]}],"bundled":21},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-53.oe2003sp4"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.55.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.55.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.75.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.75.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.75.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.75.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm15"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm16"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm15"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm13"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.0.1-3ubuntu2+esm4"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1+esm17"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm15"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm16"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm15"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm13"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.0.1-3ubuntu2+esm4"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-2.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-2.1"}]}],"bundled":29},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-3.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","tags":["issue-tracking","Issue Tracking","Patch","report","web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","tags":["patch","Patch","fix","web","report"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing","tags":["third-party-advisory","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-g9rh-4g64-7qxg","tags":["web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65706.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-65706","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0398.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36272","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3543","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3544","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3545","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263934-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272755","tags":["report"]},{"url":"https://bugzilla.suse.com/1272757","tags":["report"]},{"url":"https://bugzilla.suse.com/1272759","tags":["report"]},{"url":"https://bugzilla.suse.com/1272761","tags":["report"]},{"url":"https://bugzilla.suse.com/1272762","tags":["report"]},{"url":"https://bugzilla.suse.com/1272763","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269550","tags":["report"]},{"url":"https://bugzilla.suse.com/1272760","tags":["report"]},{"url":"https://bugzilla.suse.com/1274268","tags":["report"]},{"url":"https://bugzilla.suse.com/1274270","tags":["report"]},{"url":"https://bugzilla.suse.com/1274282","tags":["report"]},{"url":"https://bugzilla.suse.com/1274287","tags":["report"]},{"url":"https://bugzilla.suse.com/1274289","tags":["report"]},{"url":"https://bugzilla.suse.com/1276408","tags":["report"]},{"url":"https://bugzilla.suse.com/1276409","tags":["report"]},{"url":"https://bugzilla.suse.com/1276410","tags":["report"]},{"url":"https://bugzilla.suse.com/1276412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264150-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-65706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65706","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8716-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8716-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-64830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-65703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-65704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-65705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-64831","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75147","tags":["web"]},{"url":"https://bugzilla.suse.com/1220546","tags":["report"]},{"url":"https://bugzilla.suse.com/1220549","tags":["report"]},{"url":"https://bugzilla.suse.com/1234017","tags":["report"]},{"url":"https://bugzilla.suse.com/1234029","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://bugzilla.suse.com/1268595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269490","tags":["report"]},{"url":"https://bugzilla.suse.com/1272764","tags":["report"]},{"url":"https://bugzilla.suse.com/1276407","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8461","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-65706","title":"FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T19:05:11.56Z","modified":"2026-07-28T01:06:13.738Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787","CWE-131"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-48373","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T19:05:11Z","modified":"2026-07-28T01:06:13Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:33.420584Z"}],"ghsa":[{"id":"GHSA-g9rh-4g64-7qxg","title":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T21:31:02Z","modified":"2026-07-23T21:31:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T15:09:44.794906Z"}],"nvd":[{"id":"CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T20:17:22.257Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-65706","title":"FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T19:05:11.56Z","modified":"2026-11-07T10:47:28.663802133Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-131","CWE-787"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T20:17:22.257Z","modified":"2026-10-25T10:01:15.091739601Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"JLSEC-2026-1181","title":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the `vf_swaprect` video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The `filter_frame()` function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-08-07T13:27:45.313Z","modified":"2026-08-08T23:15:04.379558697Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-3541","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg\u0026apos;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u0026gt;q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0026apos;s VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer\u0026apos;s demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder\u0026apos;s bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0\u0026apos;s single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx-\u0026gt;inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer\u0026apos;s fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)","status":"published","published":"2026-08-30T04:15:41Z","modified":"2026-08-30T04:31:56.522626743Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3542","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg\u0026apos;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u0026gt;q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0026apos;s VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.(CVE-2026-64831)\n\nFFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.(CVE-2026-64832)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.(CVE-2026-64835)\n\nFFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.(CVE-2026-65703)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer\u0026apos;s demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder\u0026apos;s bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.(CVE-2026-65705)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0\u0026apos;s single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame\u0026apos;s worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.(CVE-2026-66038)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx-\u0026gt;inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer\u0026apos;s fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.(CVE-2026-75143)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)","status":"published","published":"2026-08-30T04:15:52Z","modified":"2026-08-30T04:32:02.981012274Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3543","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg\u0026apos;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u0026gt;q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0026apos;s VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.(CVE-2026-64831)\n\nFFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.(CVE-2026-64832)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.(CVE-2026-64835)\n\nFFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.(CVE-2026-65703)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer\u0026apos;s demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder\u0026apos;s bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.(CVE-2026-65705)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0\u0026apos;s single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame\u0026apos;s worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.(CVE-2026-66038)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx-\u0026gt;inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer\u0026apos;s fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.(CVE-2026-75143)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)","status":"published","published":"2026-08-30T04:16:02Z","modified":"2026-08-30T04:32:02.976901745Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3544","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg\u0026apos;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u0026gt;q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0026apos;s VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.(CVE-2026-64831)\n\nFFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.(CVE-2026-64832)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.(CVE-2026-64835)\n\nFFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.(CVE-2026-65703)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer\u0026apos;s demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder\u0026apos;s bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.(CVE-2026-65705)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0\u0026apos;s single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame\u0026apos;s worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.(CVE-2026-66038)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx-\u0026gt;inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer\u0026apos;s fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.(CVE-2026-75143)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)","status":"published","published":"2026-08-30T04:16:13Z","modified":"2026-08-30T04:32:02.975580379Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3545","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg\u0026apos;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u0026gt;q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg\u0026apos;s VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer\u0026apos;s demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder\u0026apos;s bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0\u0026apos;s single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx-\u0026gt;inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer\u0026apos;s fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)","status":"published","published":"2026-08-30T04:16:20Z","modified":"2026-08-30T04:32:26.921438572Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-23T20:17:00Z","modified":"2026-10-17T12:56:24.485044596Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"MGASA-2026-0398","title":"Updated ffmpeg package fixes security vulnerabilities","description":"Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)\nHeap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)\nDouble-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)\nOut-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)\nInfinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)\nOut-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)\nOut-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)\nOut-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)\nvf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)\nvf_swaprect Out-of-Bounds Write via NV12 Frame Processing.\n(CVE-2026-65706)\nHeap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)\nIAMF Demuxer Uncontrolled Resource Consumption via\nmix_presentation_obu(). (CVE-2026-66037)\nLCL/ZLIB Video Decoder Information Disclosure via lcldec.c.\n(CVE-2026-66038)\nMACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.\n(CVE-2026-66039)\nHeap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)\nDVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)\nUninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)\nUninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)\nUninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)\nHeap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.\n(CVE-2026-70632)\nHeap Buffer Overflow in hvcC Box Writer via HEVC Muxing.\n(CVE-2026-75141)\nStack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)\nHeap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)\nHeap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)\nOut-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)\n","status":"published","published":"2026-09-13T05:39:56Z","modified":"2026-09-13T05:45:03.27451739Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11545-1","title":"ffmpeg-9-libavcodec-devel-9.0.1-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-08-21T09:15:33.277402354Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11563-1","title":"ffmpeg-4-4.4.8-4.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.8-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-21T00:00:00Z","modified":"2026-08-22T18:23:35.045884789Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11665-1","title":"ffmpeg-7-7.1.5-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:10.223876815Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11682-1","title":"ffmpeg-8-8.1.2-3.1 on GA media","description":"These are all security issues fixed in the ffmpeg-8-8.1.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.952896818Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21877-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).\n- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).\n- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\n  h_subpel_filters_outer (bsc#1234029).\n- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if\n  video encoding parameters were being exported, as the side data would be attached in the decoder thread while\n  (bsc#1234017).\n- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c\n  (bsc#1237382).\n- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).\n- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n\nChanges for ffmpeg-7:\n\nUpdate to version 7.1.5:\n * Various crash, out-of-bounds access, add boundary check\n fixes. Affected: .mov parser, DASH parser, Snow encoder,\n Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech,\n ADPCM, Matroska decoder\n * avcodec/jpeg2000dec: clear array length when freeing it\n (CVE-2025-22921, bsc#1237382)\n * avcodec/magicyuv: Fix 1 line MEDIAN slices\n (CVE-2026-8461, bsc#1269490)\n * avcodec/magicyuv: reject slice_height misaligned with chroma vshift.\n * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check.\n * avcodec/rasc: fix heap use-after-free in decode_move().\n (CVE-2026-12706, bsc#1268595)\n * avformat/hls: Be more picky on extensions.\n (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)\n * lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is\n calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so\n a thread for vp9 decoding might get stuck.\n (CVE-2024-36615, bsc#1234017).\n * avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585)\n (CVE-2024-36615, bsc#1234017)\n * lavc/vp9: Fix regression introduced in 0ba0585.\n * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and\n h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6.\n (CVE-2024-35367, bsc#1234029)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.629800263Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:3934-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2026-64833: out-of-bounds read in the S/PDIF muxer via a crafted DTS stream with a `core_size` value larger than\n  the actual packet length (bsc#1272755).\n- CVE-2026-64834: infinite loop in the RTP/ASF demuxer via a crafted RTP/ASF stream (bsc#1272757).\n- CVE-2026-65703: out-of-bounds write in the TDSC video decoder via a crafted AVI file that changes frame dimensions\n  across TDSF frames(bsc#1272759).\n- CVE-2026-65705: out-of-bounds write in the `vf_floodfill` video filter via a dynamically sized video stream with\n  filtergraph reinitialization disabled via `-reinit_filter 0` (bsc#1272761).\n- CVE-2026-65706: out-of-bounds write in the `vf_swaprect` video filter via a crafted NV12 video frame with odd width\n  dimensions(bsc#1272762).\n- CVE-2026-66036: out-of-bounds write in the `vf_hqdn3d` filter via a crafted video whose frame resolution increases\n  between frames when filtergraph reinitialization is disabled via the `-reinit_filter 0` option (bsc#1272763).\n","status":"published","published":"2026-09-03T07:23:18Z","modified":"2026-09-10T18:23:21.578328722Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4149-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n","status":"published","published":"2026-09-14T08:02:23Z","modified":"2026-09-15T17:00:05.449619465Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4150-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n","status":"published","published":"2026-09-14T08:02:56Z","modified":"2026-09-15T17:00:04.820440733Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8716-1","title":"Several security issues were fixed in FFmpeg.","description":"It was discovered that FFmpeg incorrectly handled certain crafted media\nfiles in the VobSub subtitle demuxer. An attacker could possibly use\nthis issue to cause a denial of service or execute arbitrary code.\n(CVE-2026-64830)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted DTS\naudio streams in the S/PDIF muxer. An attacker could possibly use this\nissue to cause a denial of service or expose sensitive information.\n(CVE-2026-64833)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF\nstreams. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-64834)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted ADX\naudio files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04\nLTS. (CVE-2026-64835)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted AVI\nfiles in the TDSC video decoder. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code.\n(CVE-2026-65703)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted\nffconcat files processed via the TY demuxer. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.\n(CVE-2026-65704)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted video\nstreams in the vf_floodfill video filter. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04\nLTS. (CVE-2026-65705)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted NV12\nvideo frames in the vf_swaprect video filter. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04\nLTS. (CVE-2026-65706)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted hvcC\nNAL arrays in the HEVC parser. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code.\n(CVE-2026-75141)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted MPEG\nsystem headers. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2026-75142)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted\nnetwork input in the librist protocol handler. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted Dirac\ndata units in the VC2 HQ RTP packetizer. An attacker could possibly use\nthis issue to cause a denial of service or execute arbitrary code.\n(CVE-2026-75144)\n\nIt was discovered that FFmpeg incorrectly handled certain crafted DASH\nmanifests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)","status":"published","published":"2026-09-03T11:06:14Z","modified":"2026-09-03T22:56:56.577590484Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8716-2","title":"ffmpeg vulnerabilities","description":"USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides\nthe corresponding fix for Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that FFmpeg incorrectly handled certain crafted media\n files in the VobSub subtitle demuxer. An attacker could possibly use\n this issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-64830)\n\n It was discovered that FFmpeg incorrectly handled certain crafted HEVC\n bitstreams in the Vulkan HEVC hardware decoder. An attacker could\n possibly use this issue to cause a denial of service or execute\n arbitrary code. (CVE-2026-64831)\n\n It was discovered that FFmpeg incorrectly handled certain crafted video\n files in the NVDEC hardware decoder. An attacker could possibly use\n this issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-64832)\n\n It was discovered that FFmpeg incorrectly handled certain crafted DTS\n audio streams in the S/PDIF muxer. An attacker could possibly use this\n issue to cause a denial of service or expose sensitive information.\n (CVE-2026-64833)\n\n It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF\n streams. An attacker could possibly use this issue to cause a denial of\n service. (CVE-2026-64834)\n\n It was discovered that FFmpeg incorrectly handled certain crafted ADX\n audio files. An attacker could possibly use this issue to cause a\n denial of service or execute arbitrary code. (CVE-2026-64835)\n\n It was discovered that FFmpeg incorrectly handled certain crafted AVI\n files in the TDSC video decoder. An attacker could possibly use this\n issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-65703)\n\n It was discovered that FFmpeg incorrectly handled certain crafted\n ffconcat files processed via the TY demuxer. An attacker could possibly\n use this issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-65704)\n\n It was discovered that FFmpeg incorrectly handled certain crafted video\n streams in the vf_floodfill video filter. An attacker could possibly\n use this issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-65705)\n\n It was discovered that FFmpeg incorrectly handled certain crafted NV12\n video frames in the vf_swaprect video filter. An attacker could\n possibly use this issue to cause a denial of service or execute\n arbitrary code. (CVE-2026-65706)\n\n It was discovered that FFmpeg incorrectly handled certain crafted hvcC\n NAL arrays in the HEVC parser. An attacker could possibly use this\n issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-75141)\n\n It was discovered that FFmpeg incorrectly handled certain crafted MPEG\n system headers. An attacker could possibly use this issue to cause a\n denial of service or execute arbitrary code. (CVE-2026-75142)\n\n It was discovered that FFmpeg incorrectly handled certain crafted\n network input in the librist protocol handler. An attacker could\n possibly use this issue to cause a denial of service or execute\n arbitrary code. (CVE-2026-75143)\n\n It was discovered that FFmpeg incorrectly handled certain crafted Dirac\n data units in the VC2 HQ RTP packetizer. An attacker could possibly use\n this issue to cause a denial of service or execute arbitrary code.\n (CVE-2026-75144)\n\n It was discovered that FFmpeg incorrectly handled certain crafted DASH\n manifests. An attacker could possibly use this issue to cause a denial\n of service or expose sensitive information. (CVE-2026-75146)","status":"published","published":"2026-09-09T17:27:15Z","modified":"2026-09-10T00:57:22.296288548Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}