CVE-2026-19206

CVE-2026-19206 affects MZ Automation libiec61850 up to 1.6.1 , specifically the SVReceiver_stopThreadless function in the ASDU Element Handler (src/sampled_values/sv_subscriber.c). The issue is a heap-based buffer overflow caused by manipulation of the code path, with a local attack vector and a ...

CVE-2026-19206 MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

CVE-2026-19206 MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

JLSEC-2026-1179 FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause...

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

JLSEC-2026-1180 FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the...

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

JLSEC-2026-1182 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

JLSEC-2026-1186 FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

JLSEC-2026-1189 FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

JLSEC-2026-1184 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

JLSEC-2026-1181 FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

JLSEC-2026-1175 FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF...

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...

JLSEC-2026-1176 FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer...

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...

JLSEC-2026-1170

Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder libavcodec/rv60dec.c. The quantization parameter qp validation at line 2267 only checks the lower bound qp 0 but is missing upper bound validation. The qp value can reach 65 base value 63 from 6-bit frame header + offset +2 from...

JLSEC-2026-1177 FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX...

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...

JLSEC-2026-1190 FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

JLSEC-2026-1185 FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

JLSEC-2026-1191 FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory...

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates...

JLSEC-2026-1187 FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vfquirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose seco...

JLSEC-2026-1172 FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub...

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

JLSEC-2026-1188 FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow...

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...