[SECURITY] Fedora 45 Update: mpv-mpris-1.2-4.fc45

mpv-mpris allows control of mpv using standard media keys This plugin implements the MPRIS D-Bus interface and can be controlled using tools such as playerctl or through many Linux DEs, such as Gnome and KDE...

[SECURITY] Fedora 45 Update: mpv-0.41.0-10.fc45

Mpv is a movie player based on MPlayer and mplayer2. It supports a wide varie ty of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different...

SUSE CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

ANT-2026-3T6Q6WE9 · mpv · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3T6Q6WE9: Integer overflow in scaletempo audio filter...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68139

CVE-2026-68139 affects the Linux kernel mlx5e/MPV path. After PCIe DPC recovery, mlx5 reloads affected PCIe functions and replays multiport affiliation events; during resume, an RDMA multiport binding replay triggers an MPV_DEVCOM_MASTER_UP. The host panics with a NULL pointer dereference in mlx5...

EUVD-2026-55520

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

Ankitects Anki arbitrary script execution vulnerability

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability...

OPENSUSE-SU-2026:21267-1 Recommended update for mpv, libKPipeWireRecord6, ffmpegthumbs-kf5

This update for mpv, libKPipeWireRecord6, ffmpegthumbs-kf5 fixes the following issues:...

PT-2026-60823

This update for mpv, libKPipeWireRecord6, ffmpegthumbs-kf5 fixes the following issues:...

CVE-2026-47114 IINA < 1.4.3 Command Execution via iina://open URL Scheme

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that pass...

CVE-2026-47114 IINA < 1.4.3 Command Execution via iina://open URL Scheme

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that pass...

CVE-2026-47114 IINA < 1.4.3 Command Execution via iina://open URL Scheme

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that pass...

mpv:fuzzer_protocol_edl: Stack-buffer-overflow in autoload_external_files

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=5174388306804736 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerprotocoledl Job Type: libfuzzerasanmpv Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...

JLSEC-2026-476

A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file...

PT-2026-41612

A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file...

MINI-5MPV-585C-QF7M

Bulletin has no description...

mpv:fuzzer_loadfile: Use-of-uninitialized-value in ff_hNUMBER_sei_message_decode

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=6400061390258176 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfile Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

mpv:fuzzer_protocol_file: Use-of-uninitialized-value in binkaudio_receive_frame

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=6563083979128832 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerprotocolfile Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...