{"id":"CVE-2026-8461","aliases":["ALPINE-CVE-2026-8461","DEBIAN-CVE-2026-8461","EUVD-2026-37878","GHSA-qff7-4q6c-m8h6","JLSEC-2026-653","MGASA-2026-0249","OESA-2026-2696","OESA-2026-2697","OESA-2026-2826","OESA-2026-2829","RHSA-2026:43711","RHSA-2026:74089","SUSE-SU-2026:3529-1","SUSE-SU-2026:3542-1","SUSE-SU-2026:3632-1","UBUNTU-CVE-2026-8461","USN-8750-1","openSUSE-SU-2026:11347-1","openSUSE-SU-2026:11360-1","openSUSE-SU-2026:11384-1","openSUSE-SU-2026:11515-1","openSUSE-SU-2026:21877-1"],"status":"published","title":"Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01572,"percentile":0.75582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2026-06-18T11:29:00Z","modified":"2026-11-03T06:32:57Z","exploits":[{"source":"pocgithub","id":"anyanything/CVE-2026-8461-PoC","title":"anyanything/CVE-2026-8461-PoC","date":"2026-06-23","url":"https://github.com/anyanything/CVE-2026-8461-PoC"},{"source":"pocgithub","id":"HORKimhab/CVE-2026-8461","title":"HORKimhab/CVE-2026-8461","date":"2026-06-24","url":"https://github.com/HORKimhab/CVE-2026-8461"},{"source":"pocgithub","id":"Y5neKO/CVE-2026-8461-EXP","title":"Y5neKO/CVE-2026-8461-EXP","date":"2026-06-24","url":"https://github.com/Y5neKO/CVE-2026-8461-EXP"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-8461","title":"ashrafzaryouh/CVE-2026-8461","date":"2026-06-26","url":"https://github.com/ashrafzaryouh/CVE-2026-8461"},{"source":"pocgithub","id":"se1ims/PixelSmash","title":"se1ims/PixelSmash","date":"2026-09-24","url":"https://github.com/se1ims/PixelSmash"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["8.1.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.5-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:8.1.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["8.1.2+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_nogpl_jll","fixed_in":["8.1.2+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["8.1.2+0"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"ffmpeg","fixed_in":["7.1.5-1.mga10","7.1.5-1.mga10.tainted"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"ffmpeg","fixed_in":["5.1.9-1.1.mga9","5.1.9-1.1.mga9.tainted"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","fixed_in":["6.1.1-30.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","fixed_in":["3.4.2-150200.11.76.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm17"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","fixed_in":["7:4.4.2-0ubuntu0.22.04.1+esm16"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","fixed_in":["7.1.5-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1","7:5.1.7-0+deb12u1","7:5.1.8-0+deb12u1","7:5.1.9-0+deb12u1","7:6.0-1","7:6.0-2","7:6.0-3","7:6.0-4","7:6.0-5","7:6.0-6","7:6.0-7","7:6.0-8","7:6.0-9","7:6.1-1","7:6.1-2","7:6.1-3","7:6.1-4","7:6.1-5","7:6.1.1-1","7:6.1.1-2","7:6.1.1-3","7:6.1.1-4","7:6.1.1-5","7:7.0-1","7:7.0.1-1","7:7.0.1-2","7:7.0.1-3","7:7.0.1-4","7:7.0.1-5","7:7.0.2-1","7:7.0.2-2","7:7.0.2-3","7:7.1-1","7:7.1-2","7:7.1-3","7:7.1-4","7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.5-0+deb13u1"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1","7:7.1.4-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.1.2-1"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4"]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.2+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_nogpl_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.2+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.mga10.tainted"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-1.1.mga9.tainted"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-30.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-30.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-39.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-39.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"ffmpeg-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavcodec-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavcodec-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavcodec-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavdevice-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavdevice-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavdevice-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavfilter-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavfilter-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavfilter-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavformat-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavformat-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavformat-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavutil-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavutil-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libavutil-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libpostproc-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libpostproc-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libpostproc-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswresample-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswresample-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswresample-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswscale-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswscale-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libswscale-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-1.el9ai"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"ffmpeg-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavcodec-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavcodec-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavcodec-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavdevice-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavdevice-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavdevice-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavfilter-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavfilter-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavfilter-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavformat-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavformat-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavformat-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavutil-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavutil-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libavutil-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libpostproc-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libpostproc-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libpostproc-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswresample-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswresample-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswresample-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswscale-free-rhai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswscale-free-rhai-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.0::el9","package":"libswscale-free-rhai-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.6-9.el9ai"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150400.3.72.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-150600.13.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.76.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm17"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm16"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12","7:6.1.1-3ubuntu5+esm13","7:6.1.1-3ubuntu5+esm15"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4","7:7.1.1-1ubuntu4.1","7:7.1.1-1ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm17"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm16"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.8-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.5 for rhel 9"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","tags":["web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8461","tags":["vdb-entry","x_refsource_REDHAT","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490308","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43711","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qff7-4q6c-m8h6","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-8461","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8461","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0249.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35746","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00272.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2697","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2829","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/AIPCC-27615","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43711.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8461","tags":["advisory","report"]},{"url":"https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","tags":["advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","tags":["article"]},{"url":"https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74089","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74089.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40962","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-64830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","tags":["article"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-64834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506191","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","tags":["article"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-64835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","tags":["article"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506909","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","tags":["article"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506937","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","tags":["advisory"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","tags":["article"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269490","tags":["report"]},{"url":"https://bugzilla.suse.com/1272752","tags":["report"]},{"url":"https://bugzilla.suse.com/1272754","tags":["report"]},{"url":"https://bugzilla.suse.com/1272758","tags":["report"]},{"url":"https://bugzilla.suse.com/1272765","tags":["report"]},{"url":"https://bugzilla.suse.com/1272768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8461","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263542-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263632-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8461","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8750-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-30999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70631","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30997","tags":["web"]},{"url":"https://bugzilla.suse.com/1220546","tags":["report"]},{"url":"https://bugzilla.suse.com/1220549","tags":["report"]},{"url":"https://bugzilla.suse.com/1234017","tags":["report"]},{"url":"https://bugzilla.suse.com/1234029","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://bugzilla.suse.com/1269550","tags":["report"]},{"url":"https://bugzilla.suse.com/1272755","tags":["report"]},{"url":"https://bugzilla.suse.com/1272757","tags":["report"]},{"url":"https://bugzilla.suse.com/1272759","tags":["report"]},{"url":"https://bugzilla.suse.com/1272760","tags":["report"]},{"url":"https://bugzilla.suse.com/1272761","tags":["report"]},{"url":"https://bugzilla.suse.com/1272762","tags":["report"]},{"url":"https://bugzilla.suse.com/1272763","tags":["report"]},{"url":"https://bugzilla.suse.com/1272764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274268","tags":["report"]},{"url":"https://bugzilla.suse.com/1274270","tags":["report"]},{"url":"https://bugzilla.suse.com/1274282","tags":["report"]},{"url":"https://bugzilla.suse.com/1274287","tags":["report"]},{"url":"https://bugzilla.suse.com/1274289","tags":["report"]},{"url":"https://bugzilla.suse.com/1276407","tags":["report"]},{"url":"https://bugzilla.suse.com/1276408","tags":["report"]},{"url":"https://bugzilla.suse.com/1276409","tags":["report"]},{"url":"https://bugzilla.suse.com/1276410","tags":["report"]},{"url":"https://bugzilla.suse.com/1276412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-8461","title":"Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T11:29:00.668Z","modified":"2026-07-23T12:08:03.56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787","CWE-787"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-37878","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T11:29:00Z","modified":"2026-07-23T12:08:03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:44.433437Z"}],"ghsa":[{"id":"GHSA-qff7-4q6c-m8h6","title":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV...","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T15:32:03Z","modified":"2026-07-23T12:32:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:41.900753Z"}],"nvd":[{"id":"CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T14:17:36.66Z","modified":"2026-07-23T12:18:51.763Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T14:17:36.66Z","modified":"2026-11-03T06:32:57.090878546Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"DEBIAN-CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.   This vulnerability is associated with the file libavcodec/magicyuv.C.    This issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T14:17:36.66Z","modified":"2026-10-01T03:03:51.265793303Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"JLSEC-2026-653","title":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV...","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\nThis vulnerability is associated with the file `libavcodec/magicyuv.C`.\n\nThis issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-26T20:24:16.337Z","modified":"2026-07-25T18:24:44.144907436Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2696","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg s TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.(CVE-2023-6602)\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-06-24T11:11:37Z","modified":"2026-08-18T01:20:05.485063971Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2697","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-06-24T11:11:37Z","modified":"2026-08-18T01:20:05.533048787Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2826","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.439044123Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2829","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in FFmpeg\u0026apos;s RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).(CVE-2026-12706)\n\nAn out-of-bounds write vulnerability in FFmpeg\u0026apos;s libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.(CVE-2026-8461)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:14.576968242Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:43711","title":"Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg","status":"published","published":"2026-07-23T10:14:34Z","modified":"2026-10-20T10:09:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:74089","title":"Red Hat Security Advisory: RHEL AI 3.0 RPM runtime CVE fix - ffmpeg","status":"published","published":"2026-10-01T10:21:19Z","modified":"2026-10-20T10:15:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.  This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.","status":"published","published":"2026-06-18T14:17:00Z","modified":"2026-10-17T13:01:12.735164554Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"MGASA-2026-0249","title":"Updated ffmpeg packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV\ndecoder. (CVE-2026-8461)\n","status":"published","published":"2026-07-13T23:18:23Z","modified":"2026-07-13T23:30:05.284502529Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11347-1","title":"ffmpeg-8-8.1.2-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-8-8.1.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:05.024428361Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11360-1","title":"ffmpeg-4-4.4.8-2.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-24T00:00:00Z","modified":"2026-07-25T18:24:56.582432863Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11384-1","title":"ffmpeg-7-7.1.5-1.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-28T18:24:15.656799668Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11515-1","title":"ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media","description":"These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.658519358Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21877-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).\n- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).\n- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\n  h_subpel_filters_outer (bsc#1234029).\n- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if\n  video encoding parameters were being exported, as the side data would be attached in the decoder thread while\n  (bsc#1234017).\n- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c\n  (bsc#1237382).\n- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).\n- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n\nChanges for ffmpeg-7:\n\nUpdate to version 7.1.5:\n * Various crash, out-of-bounds access, add boundary check\n fixes. Affected: .mov parser, DASH parser, Snow encoder,\n Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech,\n ADPCM, Matroska decoder\n * avcodec/jpeg2000dec: clear array length when freeing it\n (CVE-2025-22921, bsc#1237382)\n * avcodec/magicyuv: Fix 1 line MEDIAN slices\n (CVE-2026-8461, bsc#1269490)\n * avcodec/magicyuv: reject slice_height misaligned with chroma vshift.\n * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check.\n * avcodec/rasc: fix heap use-after-free in decode_move().\n (CVE-2026-12706, bsc#1268595)\n * avformat/hls: Be more picky on extensions.\n (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)\n * lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is\n calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so\n a thread for vp9 decoding might get stuck.\n (CVE-2024-36615, bsc#1234017).\n * avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585)\n (CVE-2024-36615, bsc#1234017)\n * lavc/vp9: Fix regression introduced in 0ba0585.\n * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and\n h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6.\n (CVE-2024-35367, bsc#1234029)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.629800263Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:3529-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nUpdate to release 4.4.8.\n  \n- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution\n  (bsc#1269490).\n- CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).\n- CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution\n  (bsc#1272752).\n- CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption\n  (bsc#1272754).\n- CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory\n  corruption (bsc#1272758).\n- CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information\n  disclosure (bsc#1272768).\n- CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code\n  execution (bsc#1272765).\n\nOther updates and bugfixes:\n\n- Release 4.4.8\n  * Various bug fixes to codecs\n  * avcodec/magicyuv: Fix 1 line MEDIAN slices \n  * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check\n  * avcodec/magicyuv: reject slice_height misaligned with chroma vshift\n","status":"published","published":"2026-08-07T14:23:26Z","modified":"2026-08-08T09:00:06.081949067Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3542-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nUpdate to release 4.4.8.\n  \n- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution\n  (bsc#1269490).\n- CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).\n- CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution\n  (bsc#1272752).\n- CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption\n  (bsc#1272754).\n- CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory\n  corruption (bsc#1272758).\n- CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information\n  disclosure (bsc#1272768).\n- CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code\n  execution (bsc#1272765).\n\nOther updates and bugfixes:\n\n- Release 4.4.8\n  * Various bug fixes to codecs\n  * avcodec/magicyuv: Fix 1 line MEDIAN slices\n  * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check\n  * avcodec/magicyuv: reject slice_height misaligned with chroma vshift\n","status":"published","published":"2026-08-10T12:50:29Z","modified":"2026-08-11T09:15:06.860379097Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3632-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issue:\n\n- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution\n  (bsc#1269490).\n","status":"published","published":"2026-08-17T16:54:04Z","modified":"2026-08-18T09:30:04.687731621Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8750-1","title":"ffmpeg vulnerabilities","description":"Seung Min Shin discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could cause a denial of\nservice. (CVE-2026-12706)\n\nXinghang Lv discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could cause a denial of\nservice. (CVE-2026-30999)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. If a user or automated system were tricked into opening a\nspecially crafted file, an attacker could cause a denial of service.\n(CVE-2026-58049)\n\nAdrian Junge discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could leak sensitive\ninformation. (CVE-2026-70629, CVE-2026-70630, CVE-2026-70631)\n\nOri Hollander discovered that FFmpeg did not correctly handle certain\nmemory operations. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could possibly cause a\ndenial of service or execute arbitrary code. (CVE-2026-8461)","status":"published","published":"2026-09-14T03:25:59Z","modified":"2026-09-14T11:27:31.568391815Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}