CVE-2026-38343

An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the use of mcchroma in the motion.cc library. This vulnerability allows attackers to cause a Denial of Service DoS attack by using a specially crafted video file...

Astra Linux – Vulnerability in Chromium

In GFX within Google Chrome on Linux and ChromeOS, prior to version 148.0.7778.179, it was possible for a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out-of-bounds memory read via a crafted video file. Chromium security severity: Low...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the ffhevcputhevcepelpixels8sse function in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a crafted video file...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains an unknown vulnerability through the ffhevcputhevcqpelh3v3sse function in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a crafted video file...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of Media in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to bypass the same-origin policy through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in Codecs in Google Chrome before version 147.0.7727.101 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the use of putqpelfallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the putepel16fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – Vulnerability in Chromium

Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Chromium security severity: Low...

CVE-2026-70629

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...

FFmpeg 3.0 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the rsccdecodeframe path in libavcodec/rscc.c. An attacker can disclose heap memory contents by supplying a crafted RSCC video file whose compressed tile decompresses to fewer bytes than the tile geomet...

SUSE CVE-2026-70632

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

Linux Distros Unpatched Vulnerability : CVE-2026-70632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allow...

UBUNTU-CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

UBUNTU-CVE-2026-70632

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

The vulnerability of the Media component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially created video file...

The vulnerability of the GFX component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the GFX web browser components in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...