CVE-2026-109311

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the A...

CVE-2026-109311 vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the A...

OPENSUSE-SU-2026:12108-1 ffmpeg-7-7.1.5-4.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.1.5-4.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-110728

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description The software passes uploaded audio to the PyAV/FFmpeg av.open fallback using only a file-size check, which exposes a heap overflow in the FFmpeg IAMF parser. Authenticated remote attackers can exploit...

Linux Distros Unpatched Vulnerability : CVE-2026-107675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersona...

Linux Distros Unpatched Vulnerability : CVE-2026-107677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty...

Linux Distros Unpatched Vulnerability : CVE-2026-107695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...

Linux Distros Unpatched Vulnerability : CVE-2026-107696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit...

Linux Distros Unpatched Vulnerability : CVE-2026-107697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowedextensions restrictions when...

Linux Distros Unpatched Vulnerability : CVE-2026-107678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees...

Linux Distros Unpatched Vulnerability : CVE-2026-107660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen of libavformat/tlsmbedtls.c, which skips hostname...

CVE-2026-107676

A flaw was found in FFmpeg. This vulnerability allows an attacker to trigger an information disclosure by providing a specially crafted media file containing manipulated High Dynamic Range HDR metadata. When FFmpeg processes the media file during conversion or transcoding, uninitialized memory...

CVE-2026-107698

A flaw was found in ffmpeg. When handling Real-Time Streaming Protocol RTSP streams, redirect responses are followed without validating the destination address. A malicious RTSP server can exploit this flaw to conduct Server-Side Request Forgery SSRF, bypassing protocol restrictions to probe...

CVE-2026-107697

A flaw was found in FFmpeg's HTTP Live Streaming HLS demuxer. A remote attacker can exploit this issue by supplying a specially crafted master playlist that references disallowed protocols or local files. This bypasses security restrictions and causes the application to open restricted resources,...

CVE-2026-107696

A flaw was found in FFmpeg. When processing media streams using the Real-Time Streaming Protocol RTSP, the client fails to enforce a limit on redirection responses. A malicious or compromised RTSP server can repeatedly redirect requests back to itself or another host, trapping the application in ...

CVE-2026-107675

A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...

CVE-2026-107695

A flaw was found in FFmpeg. An infinite loop vulnerability in the HTTP Live Streaming HLS demuxer allows remote attackers to cause a Denial of Service DoS. By tricking a user into processing a specially crafted, self-referencing playlist file, an attacker can force the application into an endless...

CVE-2026-107678

A flaw was found in FFmpeg. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted MP4 media file containing an excessive number of encryption metadata structures. When the application recursively frees these structures, it exhausts available stack...

CVE-2026-107660

A flaw was found in ffmpeg. When establishing secure connections using the mbedTLS library, hostname verification is omitted for destinations specified directly by an IP address. A remote network attacker can exploit this flaw by presenting a certificate issued by any trusted Certificate Authorit...