CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...

Fedora 44 : baresip / libre (2026-9931bf2b85)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9931bf2b85 advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

Fedora 43 : baresip / libre (2026-ff2a4f31ce)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ff2a4f31ce advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

OPENSUSE-SU-2026:12171-1 ab-av1-0.11.7-1.1 on GA media

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117597

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...

SUSE CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the avdynamichdrplustot35 function when processing HDR10+ metadata. An attacker can access sensitive process memory by supplying crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata, causing...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

DEBIAN-CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

UBUNTU-CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg versions through 9.0.2 are vulnerable to an uninitialized memory disclosure within the av_dynamic_hdr_plus_to_t35() function. When the tone_mapping_flag is set to 0, the function fails to initialize up to three payload bytes. An attacker can exploit this by providing crafted Matroska T.35 ...

EUVD-2026-95081

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

PT-2026-108037

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description An uninitialized memory disclosure exists in the av dynamic hdr plus to t35 function. When the tone mapping flag is 0, up to three payload bytes remain uninitialized. An attacker can provide specially...

CVE-2026-107676: Use of Uninitialized Resource

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

Fedora 46 : baresip / libre (2026-b8539090fe)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-b8539090fe advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...