Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

Fixed packages 30

Vulnerabilities 6

• High 8.8
  CVE-2026-64832

  FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c

  FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 22, 2026
• High 8.1
  CVE-2026-75146

  FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

  FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragm…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Aug 19, 2026
• High 7.8
  CVE-2026-70628

  FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File

  FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overfl…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Aug 6, 2026
• High 7.8
  CVE-2026-75142

  FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

  FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive …

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Aug 19, 2026
• High 7.8
  CVE-2026-75144

  FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

  FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-…

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  Aug 19, 2026
• High 7.1
  CVE-2026-64833

  FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c

  FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. …

  FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  Jul 22, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://issues.redhat.com/browse/RHAI-14656
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94488.json
• report
  https://access.redhat.com/security/cve/CVE-2026-64832
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64832
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64832
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664
• article
  https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c
• report
  https://access.redhat.com/security/cve/CVE-2026-64833
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506192
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64833
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64833
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661
• article
  https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c
• report
  https://access.redhat.com/security/cve/CVE-2026-70628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2512243
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-70628
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-70628
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897
• report
  https://access.redhat.com/security/cve/CVE-2026-75142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519759
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-75142
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-75142
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087
• article
  https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c
• report
  https://access.redhat.com/security/cve/CVE-2026-75144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519760
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-75144
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-75144
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818
• article
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091
• article
  https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer