CVE-2026-80907 drm/amdgpu: Fix UVD dpb min size calculation for H264

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

EUVD-2026-71666

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

CVE-2026-80907

This CVE affects the drm/amdgpu driver in the Linux kernel, specifically the UVD (Unified Video Decoder) subsystem used for hardware-accelerated H.264 decoding. The bug is an incorrect DPB (Decoded Picture Buffer) minimum size calculation : the code derived the number of reference frames from the...

CVE-2026-80907

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

UBUNTU-CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68106 drm/amdgpu: fix division by zero with invalid uvd dimensions

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

EUVD-2026-55487

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

Linux Distros Unpatched Vulnerability : CVE-2026-68229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses...

EUVD-2026-53768

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1994)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1994 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2012)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2012 advisory. Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex...

CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

CVE-2026-66401

CVE-2026-66401 affects FreeRDP prior to 3.29.0. The vulnerability is an out-of-bounds heap read in the UVC H.264 extension-unit parser that does not validate descriptor length before accessing the GUID field. A local attacker using a malicious USB video camera can trigger a heap read beyond alloc...

CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

CVE-2026-66401 FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. CVE-2026-52720: invalid che...

SUSE-SU-2026:3125-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. - CVE-2026-52720:...