Red Hat Security Advisory: RHEL AI 3.0 RPM runtime CVE fix - ffmpeg

Fixed packages 30

Vulnerabilities 8

• High 8.8
  CVE-2026-64830

  FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer

  FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the f…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 22, 2026
• High 8.8
  CVE-2026-64835

  FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder

  FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 22, 2026
• High 8.8
  CVE-2026-66036

  FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

  FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 24, 2026
• High 8.8
  CVE-2026-66039

  FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

  FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craf…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 24, 2026
• High 8.8
  CVE-2026-8461 Public exploit

  Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

  An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magic…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Alpine Wolfi
  Jun 18, 2026
• High 8.6
  CVE-2026-58049

  FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

  FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access s…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  Jun 28, 2026
• High 7.5
  CVE-2026-64834

  FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer

  FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fail…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 22, 2026
• Medium 4.9
  CVE-2026-40962

  FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Apr 16, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74089.json
• report
  https://access.redhat.com/security/cve/CVE-2026-8461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490308
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8461
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8461
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159
• article
  https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
• report
  https://access.redhat.com/security/cve/CVE-2026-40962
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458862
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40962
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40962
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348
• report
  https://access.redhat.com/security/cve/CVE-2026-58049
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493952
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-58049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-58049
• article
  https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c
• article
  https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
• article
  https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta
• report
  https://access.redhat.com/security/cve/CVE-2026-64830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506193
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64830
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64830
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657
• article
  https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer
• report
  https://access.redhat.com/security/cve/CVE-2026-64834
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64834
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64834
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663
• article
  https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer
• report
  https://access.redhat.com/security/cve/CVE-2026-64835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506195
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64835
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64835
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e