ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:3552-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3552-1 advisory. - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-66039: MACE6 Audio...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2026-64830: heap buffer overflow via VobSub subtitle demuxer bsc1272752. CVE-2026-66039: MACE6 audio decoder heap out-of-bounds write via CAF file bsc1272765. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

SUSE-SU-2026:3552-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File bsc1272765...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

SUSE-SU-2026:3529-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

JLSEC-2026-1185 FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

OPENSUSE-SU-2026:21522-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Changes in ffmpeg-4: - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder bsc1272758 - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c bsc1272754 - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer...

SUSE CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

DEBIAN-CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

EUVD-2026-48741

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

CVE-2026-66039 affects FFmpeg up to 8.1.2 due to a signed integer overflow in the MACE6 audio decoder. An attacker can craft a CAF file with oversized values for bytes_per_packet and frames_per_packet in the desc chunk, triggering an overflow in mace_decode_frame() during output sample count comp...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039 FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...