OESA-2026-3878 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

OESA-2026-3876 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

OESA-2026-3877 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

CLEANSTART-2025-PZ70162 Security fix for CVE-2023-46407 applied in: ffmpeg 6.1-r0

Security vulnerability affects the ffmpeg package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2025-XS19180 Security fix for CVE-2023-47470 applied in: ffmpeg 6.1-r0

Security vulnerability affects the ffmpeg package. This issue is resolved in later releases. See references for vulnerability details...

ffmpeg-8-8.1.2-5.1 on GA media (moderate)

ffmpeg-8-8.1.2-5.1 on GA media Announcement ID: openSUSE-SU-2026:11794-1 Rating: moderate Cross-References: CVE-2023-6602 CVE-2026-18393 CVE-2026-38345 CVE-2026-38346 CVE-2026-38347 CVE-2026-38348 CVE-2026-38349 CVE-2026-38350 CVSS scores: CVE-2023-6602 SUSE : 3.3...

CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...

FreeRDP: FreeRDP: Denial of Service via malformed media data

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send specially crafted media data to a connected client. This malformed data can trigger a heap out-of-bounds read vulnerability within the TSMF FFmpeg decoder, leading to the client application crashing. This can...

FreeRDP: FreeRDP: Denial of Service via malformed media data

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send specially crafted media data to a connected client. This malformed data can trigger a heap out-of-bounds read vulnerability within the TSMF FFmpeg decoder, leading to the client application crashing. This can...

practice-22-23

Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...

Linux Distros Unpatched Vulnerability : CVE-2026-90815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:4149-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4149-1 advisory. - CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and...

SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:4150-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4150-1 advisory. - CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption...

OPENSUSE-SU-2026:11794-1 ffmpeg-8-8.1.2-5.1 on GA media

These are all security issues fixed in the ffmpeg-8-8.1.2-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11795-1 ffmpeg-9-libavcodec-devel-9.0.1-6.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-6.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-90816

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the HLS protocol module when handling a specially crafted HLS HTTP Live Streaming playlist due to insufficient validation of duration or targetduration parameters. This vulnerability can lead to an excessive consumption of CPU...

CVE-2026-90815

A flaw was found in FFmpeg. An out-of-bounds read can occur in the Convolution Filter when processing a specially crafted file due to insufficient bounds checks. This issue can lead to an application crash, resulting in a denial of service. Mitigation Do not process untrusted files using the...

Linux Distros Unpatched Vulnerability : CVE-2026-90816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in FFmpeg 8.0.x. This affects the function parseplaylist of the file libavformat/hlsproto.c of the component Duration Parser. Performi...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the setup3x3 function in the Convolution Filter component. An attacker can access sensitive information or cause unintended behavior by triggering an out-of-bounds read through crafted input processed remotely...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the parseplaylist function of the Duration Parser component when processing the duration or targetduration arguments. An attacker can cause a denial of service by providing specially crafted...