{"id":"CVE-2026-66041","aliases":["DEBIAN-CVE-2026-66041","EUVD-2026-48743","GHSA-frhp-m687-9g3q","JLSEC-2026-1187","MGASA-2026-0398","SUSE-SU-2026:23222-1","SUSE-SU-2026:23232-1","UBUNTU-CVE-2026-66041","openSUSE-SU-2026:11665-1","openSUSE-SU-2026:21572-1"],"status":"published","title":"FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00487,"percentile":0.42435,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-07-24T19:54:11Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:9.0.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_nogpl_jll","fixed_in":["9.0.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["9.0.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1","7:7.1.4-0+deb13u1","7:7.1.5-0+deb13u1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.2-1"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1"]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0+0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_nogpl_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0+0"},{"fixed":"9.0.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10"}]}],"bundled":25},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10.tainted"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-2.1"}]}],"bundled":29},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.4-160000.3.1"}]}],"bundled":6}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","tags":["issue-tracking","Exploit","Patch","report","web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","tags":["patch","Patch","fix","web","report"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter","tags":["third-party-advisory","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-frhp-m687-9g3q","tags":["web"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66041.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66041","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0398.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36272","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623222-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272752","tags":["report"]},{"url":"https://bugzilla.suse.com/1272754","tags":["report"]},{"url":"https://bugzilla.suse.com/1272758","tags":["report"]},{"url":"https://bugzilla.suse.com/1272765","tags":["report"]},{"url":"https://bugzilla.suse.com/1272767","tags":["report"]},{"url":"https://bugzilla.suse.com/1272768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66041","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623232-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-66041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66041","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75147","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-66041","title":"FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T19:54:11.426Z","modified":"2026-07-29T03:55:36.839Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-48743","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T19:54:11Z","modified":"2026-07-29T03:55:36Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:30.59681Z"}],"ghsa":[{"id":"GHSA-frhp-m687-9g3q","title":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T21:32:22Z","modified":"2026-07-24T21:32:28Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:48.807824Z"}],"nvd":[{"id":"CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T20:18:21.24Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:32.830533Z"}],"osv":[{"id":"CVE-2026-66041","title":"FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T19:54:11.426Z","modified":"2026-11-07T10:47:28.474093306Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T20:18:21.24Z","modified":"2026-10-25T10:01:14.475598898Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"JLSEC-2026-1187","title":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the `vf_quirc` filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing `av_image_copy_plane()` to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-08-07T13:27:45.313Z","modified":"2026-08-08T23:15:05.822455985Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.","status":"published","published":"2026-07-24T20:18:00Z","modified":"2026-10-17T12:59:18.461403331Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"MGASA-2026-0398","title":"Updated ffmpeg package fixes security vulnerabilities","description":"Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)\nHeap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)\nDouble-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)\nOut-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)\nInfinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)\nOut-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)\nOut-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)\nOut-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)\nvf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)\nvf_swaprect Out-of-Bounds Write via NV12 Frame Processing.\n(CVE-2026-65706)\nHeap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)\nIAMF Demuxer Uncontrolled Resource Consumption via\nmix_presentation_obu(). (CVE-2026-66037)\nLCL/ZLIB Video Decoder Information Disclosure via lcldec.c.\n(CVE-2026-66038)\nMACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.\n(CVE-2026-66039)\nHeap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)\nDVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)\nUninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)\nUninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)\nUninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)\nHeap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.\n(CVE-2026-70632)\nHeap Buffer Overflow in hvcC Box Writer via HEVC Muxing.\n(CVE-2026-75141)\nStack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)\nHeap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)\nHeap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)\nOut-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)\n","status":"published","published":"2026-09-13T05:39:56Z","modified":"2026-09-13T05:45:03.27451739Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11665-1","title":"ffmpeg-7-7.1.5-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:10.223876815Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21572-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).\n- CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).\n- CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).\n- CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).\n- CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).\n- CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).\n","status":"published","published":"2026-08-12T08:08:52Z","modified":"2026-08-14T18:23:42.295795742Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23222-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).\n- CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).\n- CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).\n- CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).\n- CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).\n- CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).\n","status":"published","published":"2026-08-12T08:07:23Z","modified":"2026-08-27T18:23:09.315317595Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23232-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).\n- CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).\n- CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).\n- CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).\n- CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).\n- CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).\n","status":"published","published":"2026-08-12T08:07:23Z","modified":"2026-08-27T18:23:10.27685038Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}