ffmpeg-4-4.4.8-3.1 on GA media (moderate)

ffmpeg-4-4.4.8-3.1 on GA media Announcement ID: openSUSE-SU-2026:11448-1 Rating: moderate Cross-References: CVE-2026-64830 CVE-2026-64832 CVE-2026-64835 CVE-2026-66038 CVE-2026-66039 CVSS scores: CVE-2026-64830 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2026-64830 SUSE : 8.5...

PT-2026-68788

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.4 through 8.x Description An out-of-bounds heap write exists in the native GoPro CineForm HD CFHD decoder. A remote attacker can corrupt heap memory by providing a specially crafted AVI file during stream probing. The issue...

PT-2026-68785

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.0 through 8.x Description The native RSCC decoder in libavcodec/rscc.c contains an uninitialized heap memory read issue. An attacker can disclose heap memory contents by providing a specially crafted video file containing a...

PT-2026-68787

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.5 through 8.x Description An uninitialized heap memory disclosure exists in the native TIFF decoder within libavcodec/tiff.c. An attacker can exploit this by providing a crafted TIFF file containing a valid Deflate-compressed...

PT-2026-68786

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.0 through 8.x Description An uninitialized heap memory read exists in the native Screenpresso decoder libavcodec/screenpresso.c. An attacker can recover sensitive memory contents, such as userspace addresses from persistent...

CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...

openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory. Changes in ffmpeg-4: - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder bsc1272758 - CVE-2026-64832: Double-Free in NVDEC Hardwa...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

OPENSUSE-SU-2026:11448-1 ffmpeg-4-4.4.8-3.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.8-3.1 package on the GA media of openSUSE Tumbleweed...

Security update for ffmpeg-4 (important)

openSUSE security update: security update for ffmpeg-4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21522-1 Rating: important References: bsc1272752 bsc1272754 bsc1272758 bsc1272765 bsc1272768 Cross-References: CVE-2026-64830 CVE-2026-64832...

Linux Distros Unpatched Vulnerability : CVE-2026-67290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

UBUNTU-CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-67290 FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

EUVD-2026-51865

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

OESA-2026-3211 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: Integer overflow...

OESA-2026-3207 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: Integer overflow...

CVE-2026-66037

A flaw was found in FFmpeg. An uncontrolled resource consumption vulnerability exists in the IAMF demuxer. An unauthenticated attacker can exploit this by supplying a specially crafted input file with a malicious countlabel field. This can cause the system to allocate a large amount of memory,...

CVE-2026-66041

A flaw was found in FFmpeg's vfquirc filter, which handles subtitle processing. A remote attacker can exploit this heap out-of-bounds write vulnerability by providing a specially crafted PGS/SUP subtitle file. This file, with mismatched frame dimensions, can cause the software to write data beyon...

CVE-2026-66040

A flaw was found in FFmpeg's native PNG and APNG encoders. A remote attacker can exploit this heap out-of-bounds write vulnerability by providing a specially crafted PNG image containing a malicious eXIf chunk. This can lead to heap memory corruption, a process crash, and potentially allow the...