Summary
Adrian Junge discovered that FFmpeg incorrectly handled certain subtitle
data. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2026-70628)
Adrian Junge discovered that FFmpeg incorrectly handled certain video
files. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-70632)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm16 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm14 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm15 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm14 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm12 |
Vulnerabilities 2
-
High 7.8
FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overfl…
-
High 7.8
FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. …