11 matches found
SUSE CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
DEBIAN-CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg versions prior to 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. Specifically, in mov_read_ispe(), uint32_t width and height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking. This allows values exceeding INT_MAX to become ...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611: Integer Overflow or Wraparound
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
ffmpeg:ffmpeg_dem_MOV_fuzzer: Heap-buffer-overflow in mov_read_ispe
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4996530429820928 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegdemMOVfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030000003f0 Crash...