UBUNTU-CVE-2026-125224

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125224

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125224 FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

PT-2026-141052

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis parser.c that re-parses invalid extradata for every packet when valid extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust...

CVE-2026-125224: FFmpeg: FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid…

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

SUSE CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626

A flaw was found in libass. When handling subtitle streams, the library's event pruning mechanism fails to properly validate negative Matroska ReadOrder values. An attacker who provides a specially crafted media stream to an application using libass can trigger memory corruption, resulting in an...

CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626 libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626

The libass subtitle renderer (versions 0.17.4 through 0.17.5 ) is vulnerable to an out-of-bounds bit clear because event pruning fails to guard negative Matroska ReadOrder values. An attacker can provide a malicious Matroska stream via ass_process_chunk with enabled read-order checking; subsequen...

EUVD-2026-114006

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626 libass: Out-of-bounds bit clears for negative Matroska ReadOrder values

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

Ubuntu: USN-8815-1 (CVE-2026-61626): libass vulnerabilities

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61626: libass: libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

Medium: gstreamer-plugins-good

Issue Overview: A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size o...

Amazon Linux 2 : gstreamer-plugins-good (ALAS-2026-4023)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4023 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792021687)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792021687 advisory. - GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been...

Astra Linux – Vulnerability in liblivemedia

Live555 before 2019.08.16 has a Use-After-Free issue, as GenericMediaServer::createNewClientSessionWithId can generate the same client session ID consecutively. This issue is handled improperly by the MPEG1or2 and Matroska file demultiplexors...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...

SUSE CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...