CVE-2026-70630 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

CVE-2026-70629 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-70629 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-70629

CVE-2026-70629 affects FFmpeg versions 3.0 up to but not including 9.0, in the native RSCC decoder (libavcodec/rscc.c). The issue is an unreleased/deferred validation: rscc_decode_frame() copies data via av_image_copy_plane() without ensuring the decompressed byte count matches the tile geometry,...

CVE-2026-70628 FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-70628

FFmpeg versions 0.5 up to (but not including) 9.0 are affected by a signed integer overflow in the DVB subtitle parser (libavcodec/dvbsub_parser.c) that can trigger a heap buffer overflow when processing a crafted WTV file. The overflow causes the bounds-check guard to wrap to INT_MIN, bypassing ...

CVE-2026-70628 FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

Important: Red Hat Security Advisory: Backport fixes for CVE-2026-64835 and CVE-2026-58049

Backport fixes for CVE-2026-64835 and CVE-2026-58049 CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream...

FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

ffmpeg-4-4.4.8-3.1 on GA media (moderate)

ffmpeg-4-4.4.8-3.1 on GA media Announcement ID: openSUSE-SU-2026:11448-1 Rating: moderate Cross-References: CVE-2026-64830 CVE-2026-64832 CVE-2026-64835 CVE-2026-66038 CVE-2026-66039 CVSS scores: CVE-2026-64830 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2026-64830 SUSE : 8.5...

CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...

openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory. Changes in ffmpeg-4: - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder bsc1272758 - CVE-2026-64832: Double-Free in NVDEC Hardwa...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

OPENSUSE-SU-2026:11448-1 ffmpeg-4-4.4.8-3.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.8-3.1 package on the GA media of openSUSE Tumbleweed...

Security update for ffmpeg-4 (important)

openSUSE security update: security update for ffmpeg-4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21522-1 Rating: important References: bsc1272752 bsc1272754 bsc1272758 bsc1272765 bsc1272768 Cross-References: CVE-2026-64830 CVE-2026-64832...

Linux Distros Unpatched Vulnerability : CVE-2026-67290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient...