Summary
Adrian Junge was discovered that FFmpeg incorrectly handled certain media
files. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2026-66036, CVE-2026-66039)
Adrian Junge discovered that FFmpeg incorrectly handled certain media
files. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2026-66038)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm15 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm13 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm14 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm13 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm11 |
Vulnerabilities 3
-
High 8.8
FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph…
-
High 8.8
FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craf…
-
Medium 6.5
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expe…