EUVD-2026-71145

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106212)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106212 advisory. An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106204)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106204 advisory. FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplyi...

PT-2026-85582

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106168)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106168 advisory. FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by...

CVE-2026-85696: Improper Neutralization of Special Elements used in an OS Command

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106174)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106174 advisory. FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106170)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106170 advisory. FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106195)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106195 advisory. FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106157 advisory. FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106176)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106176 advisory. FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries b...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106178 advisory. FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106183 advisory. FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106169 advisory. FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to caus...

OPENSUSE-SU-2026:11682-1 ffmpeg-8-8.1.2-3.1 on GA media

These are all security issues fixed in the ffmpeg-8-8.1.2-3.1 package on the GA media of openSUSE Tumbleweed...

USN-8716-1: FFmpeg vulnerabilities

It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-64830 It was discovered that FFmpeg incorrectly handled certain crafted DTS audi...

USN-8716-1 Several security issues were fixed in FFmpeg.

It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-64830 It was discovered that FFmpeg incorrectly handled certain crafted DTS audi...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2026-64833: out-of-bounds read in the S/PDIF muxer via a crafted DTS stream with a coresize value larger than the actual packet length bsc1272755. CVE-2026-64834: infinite loop in the RTP/ASF demuxer via a crafted RTP/ASF stream bsc1272757...