ECHO-F2C1-328C-2BC2 Vulnerability is in libavfilter/vf_quirc.c (QR decode via libquirc). Debian's ffmpeg package does not enable --enable-libquirc (default off; not present in debian/rules CONFIG), so the quirc filter is not built into our binary. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66041 - https://github.com/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 details: | Upstream fix resizes quirc buffers when input size changes. Clean upstream patch applies to the source tree, but the filter is not compiled in. If --enable-libquirc is ever added to debian/rules, convert this to a real PATCH_TYPE_UPSTREAM_PATCH entry.

Bulletin has no description...