{"id":"CVE-2026-66037","aliases":["DEBIAN-CVE-2026-66037","EUVD-2026-48739","GHSA-qqrg-chvw-q8jp","JLSEC-2026-1183","MGASA-2026-0398","UBUNTU-CVE-2026-66037","openSUSE-SU-2026:11545-1","openSUSE-SU-2026:11665-1","openSUSE-SU-2026:11682-1","openSUSE-SU-2026:21877-1"],"status":"published","title":"FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00349,"percentile":0.28817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-07-24T19:36:53Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:9.0.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_nogpl_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["9.0.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1","7:5.1.7-0+deb12u1","7:5.1.8-0+deb12u1","7:5.1.9-0+deb12u1","7:6.0-1","7:6.0-2","7:6.0-3","7:6.0-4","7:6.0-5","7:6.0-6","7:6.0-7","7:6.0-8","7:6.0-9","7:6.1-1","7:6.1-2","7:6.1-3","7:6.1-4","7:6.1-5","7:6.1.1-1","7:6.1.1-2","7:6.1.1-3","7:6.1.1-4","7:6.1.1-5","7:7.0-1","7:7.0.1-1","7:7.0.1-2","7:7.0.1-3","7:7.0.1-4","7:7.0.1-5","7:7.0.2-1","7:7.0.2-2","7:7.0.2-3","7:7.1-1","7:7.1-2","7:7.1-3","7:7.1-4","7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1","7:7.1.4-0+deb13u1","7:7.1.5-0+deb13u1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.2-1"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1"]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_nogpl_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10.tainted"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-2.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-2.1"}]}],"bundled":29},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-3.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","tags":["issue-tracking","Issue Tracking","Patch","report","web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","tags":["patch","Patch","fix","web","report"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu","tags":["third-party-advisory","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-qqrg-chvw-q8jp","tags":["web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66037.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66037","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0398.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36272","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-66037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66037","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75147","tags":["web"]},{"url":"https://bugzilla.suse.com/1220546","tags":["report"]},{"url":"https://bugzilla.suse.com/1220549","tags":["report"]},{"url":"https://bugzilla.suse.com/1234017","tags":["report"]},{"url":"https://bugzilla.suse.com/1234029","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://bugzilla.suse.com/1268595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269490","tags":["report"]},{"url":"https://bugzilla.suse.com/1269550","tags":["report"]},{"url":"https://bugzilla.suse.com/1272755","tags":["report"]},{"url":"https://bugzilla.suse.com/1272757","tags":["report"]},{"url":"https://bugzilla.suse.com/1272759","tags":["report"]},{"url":"https://bugzilla.suse.com/1272760","tags":["report"]},{"url":"https://bugzilla.suse.com/1272761","tags":["report"]},{"url":"https://bugzilla.suse.com/1272762","tags":["report"]},{"url":"https://bugzilla.suse.com/1272763","tags":["report"]},{"url":"https://bugzilla.suse.com/1272764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274268","tags":["report"]},{"url":"https://bugzilla.suse.com/1274270","tags":["report"]},{"url":"https://bugzilla.suse.com/1274282","tags":["report"]},{"url":"https://bugzilla.suse.com/1274287","tags":["report"]},{"url":"https://bugzilla.suse.com/1274289","tags":["report"]},{"url":"https://bugzilla.suse.com/1276407","tags":["report"]},{"url":"https://bugzilla.suse.com/1276408","tags":["report"]},{"url":"https://bugzilla.suse.com/1276409","tags":["report"]},{"url":"https://bugzilla.suse.com/1276410","tags":["report"]},{"url":"https://bugzilla.suse.com/1276412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8461","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-66037","title":"FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T19:36:53.859Z","modified":"2026-07-28T01:06:28.161Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-48739","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T19:36:53Z","modified":"2026-07-28T01:06:28Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:33.420584Z"}],"ghsa":[{"id":"GHSA-qqrg-chvw-q8jp","title":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T21:32:22Z","modified":"2026-07-24T21:32:28Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:09:48.807824Z"}],"nvd":[{"id":"CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T20:18:20.573Z","modified":"2026-08-07T00:58:46.967Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:32.830533Z"}],"osv":[{"id":"CVE-2026-66037","title":"FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T19:36:53.859Z","modified":"2026-11-07T10:47:28.825183042Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T20:18:20.573Z","modified":"2026-10-01T03:03:31.986057688Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"JLSEC-2026-1183","title":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted `count_label` field. The `mix_presentation_obu()` function in `libavformat/iamf_parse.c` calls `av_calloc`(`count_label`, sizeof(*`language_label`)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-08-07T13:27:45.313Z","modified":"2026-08-08T23:15:05.74326426Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.","status":"published","published":"2026-07-24T20:18:00Z","modified":"2026-10-17T12:59:17.608808995Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"MGASA-2026-0398","title":"Updated ffmpeg package fixes security vulnerabilities","description":"Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)\nHeap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)\nDouble-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)\nOut-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)\nInfinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)\nOut-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)\nOut-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)\nOut-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)\nvf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)\nvf_swaprect Out-of-Bounds Write via NV12 Frame Processing.\n(CVE-2026-65706)\nHeap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)\nIAMF Demuxer Uncontrolled Resource Consumption via\nmix_presentation_obu(). (CVE-2026-66037)\nLCL/ZLIB Video Decoder Information Disclosure via lcldec.c.\n(CVE-2026-66038)\nMACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.\n(CVE-2026-66039)\nHeap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)\nDVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)\nUninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)\nUninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)\nUninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)\nHeap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.\n(CVE-2026-70632)\nHeap Buffer Overflow in hvcC Box Writer via HEVC Muxing.\n(CVE-2026-75141)\nStack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)\nHeap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)\nHeap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)\nOut-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)\n","status":"published","published":"2026-09-13T05:39:56Z","modified":"2026-09-13T05:45:03.27451739Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11545-1","title":"ffmpeg-9-libavcodec-devel-9.0.1-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-08-21T09:15:33.277402354Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11665-1","title":"ffmpeg-7-7.1.5-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:10.223876815Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11682-1","title":"ffmpeg-8-8.1.2-3.1 on GA media","description":"These are all security issues fixed in the ffmpeg-8-8.1.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.952896818Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21877-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).\n- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).\n- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\n  h_subpel_filters_outer (bsc#1234029).\n- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if\n  video encoding parameters were being exported, as the side data would be attached in the decoder thread while\n  (bsc#1234017).\n- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c\n  (bsc#1237382).\n- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).\n- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n\nChanges for ffmpeg-7:\n\nUpdate to version 7.1.5:\n * Various crash, out-of-bounds access, add boundary check\n fixes. Affected: .mov parser, DASH parser, Snow encoder,\n Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech,\n ADPCM, Matroska decoder\n * avcodec/jpeg2000dec: clear array length when freeing it\n (CVE-2025-22921, bsc#1237382)\n * avcodec/magicyuv: Fix 1 line MEDIAN slices\n (CVE-2026-8461, bsc#1269490)\n * avcodec/magicyuv: reject slice_height misaligned with chroma vshift.\n * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check.\n * avcodec/rasc: fix heap use-after-free in decode_move().\n (CVE-2026-12706, bsc#1268595)\n * avformat/hls: Be more picky on extensions.\n (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)\n * lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is\n calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so\n a thread for vp9 decoding might get stuck.\n (CVE-2024-36615, bsc#1234017).\n * avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585)\n (CVE-2024-36615, bsc#1234017)\n * lavc/vp9: Fix regression introduced in 0ba0585.\n * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and\n h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6.\n (CVE-2024-35367, bsc#1234029)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.629800263Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}