CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

CVE-2026-70629

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...

CVE-2026-70630

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability in the native Screenpresso decoder allows attackers to recover sensitive memory contents. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpressodecodeframe function to fail i...

CVE-2026-70631

A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. This crafted file can cause the tiffunpackzlib function to include stale data from previous memory allocations in the...

PT-2026-72118

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1 Description An issue in the FFmpeg integration allows authenticated users with assets/upload permissions to execute arbitrary commands. This occurs when a video file is uploaded with a filename containing...

FFmpeg 0.5 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 0.5 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - A signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c allows attackers to trigger a heap buffer overflow by...

FFmpeg 3.0 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...

FFmpeg 4.4 < 9.0 Out-of-Bounds Heap Write (CVE-2026-70632)

The version of FFmpeg installed on the remote host is 4.4 or later but prior to 9.0. It is, therefore, affected by an out-of-bounds heap write vulnerability: - An out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder allows remote attackers to corrupt heap memory by...

OPENSUSE-SU-2026:21572-1 Security update for ffmpeg-7

This update for ffmpeg-7 fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c bsc1272754. - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder bsc1272758. -...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:3542-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3542-1 advisory. Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of...

ROOT-OS-UBUNTU-2204-CVE-2024-7055 CVE-2024-7055 in ffmpeg - Patched by Root

Root has patched CVE-2024-7055 in the ffmpeg package for Root:Ubuntu:22.04. Multiple fixed versions available...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2026-64830: heap buffer overflow via VobSub subtitle demuxer bsc1272752. CVE-2026-66039: MACE6 audio decoder heap out-of-bounds write via CAF file bsc1272765. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

SUSE-SU-2026:3552-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File bsc1272765...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

SUSE-SU-2026:3542-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream

A flaw was found in FFmpeg's RASC video decoder. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC Four Character Code, which is then decoded by libavcodec. This vulnerability triggers a bitstream-controlled out-of-bounds heap write and an adjacent...

Important: Red Hat Security Advisory: RHELAI 3.0 Backport fixes for CVE-2026-64835 and CVE-2026-58049

RHELAI 3.0 Backport fixes for CVE-2026-64835 and CVE-2026-58049 CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream...

Important: Red Hat Security Advisory: RHELAI 3.2 Backport fixes for CVE-2026-64835 and CVE-2026-58049

RHELAI 3.2 Backport fixes for CVE-2026-64835 and CVE-2026-58049 CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream...