4 matches found
CVE-2026-96611
FFmpeg versions before 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. When processing a crafted HEIF file, the mov_read_ispe() function stores uint32_t width and height values into signed integer fields without bounds checking, causing values exceeding INT_MAX to become neg...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...