ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media (moderate)

ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11515-1 Rating: moderate Cross-References: CVE-2025-10256 CVE-2025-1594 CVE-2025-9951 CVE-2026-12706 CVE-2026-30997 CVE-2026-8461 CVSS scores: CVE-2025-10256 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H...

OPENSUSE-SU-2026:11515-1 ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

EUVD-2026-58799

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

CVE-2026-70629

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...

CVE-2026-70630

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability in the native Screenpresso decoder allows attackers to recover sensitive memory contents. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpressodecodeframe function to fail i...

CVE-2026-70631

A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. This crafted file can cause the tiffunpackzlib function to include stale data from previous memory allocations in the...

FFmpeg 3.0 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...

OPENSUSE-SU-2026:21572-1 Security update for ffmpeg-7

This update for ffmpeg-7 fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c bsc1272754. - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder bsc1272758. -...

ROOT-OS-UBUNTU-2204-CVE-2024-7055 CVE-2024-7055 in ffmpeg - Patched by Root

Root has patched CVE-2024-7055 in the ffmpeg package for Root:Ubuntu:22.04. Multiple fixed versions available...

FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream

A flaw was found in FFmpeg's RASC video decoder. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC Four Character Code, which is then decoded by libavcodec. This vulnerability triggers a bitstream-controlled out-of-bounds heap write and an adjacent...

FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

Important: Red Hat Security Advisory: RHELAI 3.0 Backport fixes for CVE-2026-64835 and CVE-2026-58049

RHELAI 3.0 Backport fixes for CVE-2026-64835 and CVE-2026-58049 CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream...

Important: Red Hat Security Advisory: RHELAI 3.2 Backport fixes for CVE-2026-64835 and CVE-2026-58049

RHELAI 3.2 Backport fixes for CVE-2026-64835 and CVE-2026-58049 CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream...

FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream

A flaw was found in FFmpeg's RASC video decoder. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC Four Character Code, which is then decoded by libavcodec. This vulnerability triggers a bitstream-controlled out-of-bounds heap write and an adjacent...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the capacity check in dvbsubparse in libavcodec/dvbsubparser.c. An attacker can trigger an out-of-bounds heap write and potential code execution by supplying a crafted WTV file that drives the bufsize ...