CVE-2026-75147

FFmpeg versions before commit 983dae9 have an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). A crafted OBU size causes the remaining-size counter to wrap, letting the keyframe-detection loop dereference a pointer past the packet buffer. CVSS 3.1 scores 7.1 (HIGH). No in-...

EUVD-2026-62582

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

CVE-2026-75145 FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

CVE-2026-75145

FFmpeg before commit b4c199c contains an integer narrowing conversion flaw in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before being compared against the remaining frame size. On platforms where long is 32 bits (including 64-bit Windows ), sufficiently large ...

PT-2026-78528

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit b4c199c Description An incorrect integer narrowing conversion exists in the AV1 RTP packetizer within libavformat/rtpenc av1.c. The OBU Open Bitstream Unit size is cast to long before being compared to the...

PT-2026-78530

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 983dae9 Description An out-of-bounds read exists in the AV1 RTP packetizer within the libavformat/rtpenc av1.c file. The issue occurs during the keyframe detection loop when searching for a sequence header OBU...

gstreamer1-plugins-bad-free security update

1.26.7-2.7 - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550 1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves...

Oracle Linux 10 : gstreamer1-plugins-bad-free (ELSA-2026-55433)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55433 advisory. - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats...

The vulnerability of the `rockchip_vpu981_av1_dec_init()` function in the driver/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c file of the Linux operating system’s multimedia device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rockchipvpu981av1decinit function in the driver/media/platform/verisilicon/rockchipvpu981hwav1dec.c file of the Linux operating system’s multimedia device driver is related to incorrect calculation of buffer size. Exploiting this vulnerability could allow an attacker to...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394. Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE SLED15: gstreamer-plugins-bad / gstreamer-plugins-bad-devel / etc (SUSE-SU-2026:3527-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3527-1 advisory. This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394. Patch Instructions: To install this SUSE update use the SUSE recommended...