CVE-2026-75141

FFmpeg versions before commit acf5d7c have a heap buffer overflow in the hvcC box writer. A crafted HEVC file triggers NAL unit count overflow during muxing, leading to memory corruption; CVSS 3.1 scores it HIGH (7.8). No exploitation is confirmed. Upgrade to a version containing the fix commit. ...

SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:3632-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3632-1 advisory. This update for ffmpeg fixes the following issue: - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-102690)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102690 advisory. A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filterintra at libavfilter/vfbwdif.c, which might lead to memory corruption and other potential...

CVE-2026-75146: Out-of-bounds Read

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-102684)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102684 advisory. Buffer Overflow vulnerability exists in FFmpeg 4.1 via apngdoinverseblend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service...

OPENSUSE-SU-2026:11545-1 ffmpeg-9-libavcodec-devel-9.0.1-2.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-75142: Stack-based Buffer Overflow

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75143: Heap-based Buffer Overflow

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75144: Heap-based Buffer Overflow

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75147: Out-of-bounds Read

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...

PT-2026-78527

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1cdeb3c Description A heap buffer overflow exists in the VC-2/Dirac RTP packetizer within the libavformat/rtpenc vc2hq.c file. The issue occurs because the packetizer copies an input-derived data unit or fragmen...

PT-2026-78528

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit b4c199c Description An incorrect integer narrowing conversion exists in the AV1 RTP packetizer within libavformat/rtpenc av1.c. The OBU Open Bitstream Unit size is cast to long before being compared to the...

PT-2026-78529

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 65b0dab Description An out-of-bounds read exists in the DASH demuxer within libavformat/dashdec.c. This occurs when a live DASH manifest is refreshed with a startNumber lower than the previous value, causing the...

PT-2026-78530

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 983dae9 Description An out-of-bounds read exists in the AV1 RTP packetizer within the libavformat/rtpenc av1.c file. The issue occurs during the keyframe detection loop when searching for a sequence header OBU...

PT-2026-78524

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit acf5d7c Description A heap buffer overflow exists in the hvcC box writer. This occurs when writing an HEVC configuration record containing more NAL units of a single type than the count field can represent,...

PT-2026-78525

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 9d786e4 Description A stack buffer overflow exists in the MPEG-PS muxer within the libavformat/mpegenc.c file. This occurs when the software processes input containing more streams than the muxer's fixed-size...

PT-2026-78526

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1c10bcc Description A heap buffer overflow exists in the RIST protocol reader within libavformat/librist.c. The function librist read fails to respect its size argument, copying the entire received payload lengt...

PT-2026-80593

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-75141: Heap-based Buffer Overflow

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...

CVE-2026-75145: Incorrect Conversion between Numeric Types

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...