Summary
USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides
the corresponding fix for Ubuntu 26.04 LTS.
Original advisory details:
It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)
It was discovered that FFmpeg incorrectly handled certain crafted HEVC
bitstreams in the Vulkan HEVC hardware decoder. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-64831)
It was discovered that FFmpeg incorrectly handled certain crafted video
files in the NVDEC hardware decoder. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64832)
It was discovered that FFmpeg incorrectly handled certain crafted DTS
audio streams in the S/PDIF muxer. An attacker could possibly use this
issue to cause a denial of service or expose sensitive information.
(CVE-2026-64833)
It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-64834)
It was discovered that FFmpeg incorrectly handled certain crafted ADX
audio files. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-64835)
It was discovered that FFmpeg incorrectly handled certain crafted AVI
files in the TDSC video decoder. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65703)
It was discovered that FFmpeg incorrectly handled certain crafted
ffconcat files processed via the TY demuxer. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65704)
It was discovered that FFmpeg incorrectly handled certain crafted video
streams in the vf_floodfill video filter. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65705)
It was discovered that FFmpeg incorrectly handled certain crafted NV12
video frames in the vf_swaprect video filter. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-65706)
It was discovered that FFmpeg incorrectly handled certain crafted hvcC
NAL arrays in the HEVC parser. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75141)
It was discovered that FFmpeg incorrectly handled certain crafted MPEG
system headers. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-75142)
It was discovered that FFmpeg incorrectly handled certain crafted
network input in the librist protocol handler. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-75143)
It was discovered that FFmpeg incorrectly handled certain crafted Dirac
data units in the VC2 HQ RTP packetizer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75144)
It was discovered that FFmpeg incorrectly handled certain crafted DASH
manifests. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2026-75146)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | ffmpeg | 7:8.0.1-3ubuntu2+esm4 |
Vulnerabilities 15
-
Critical 9.8
FFmpeg Heap Buffer Overflow via RIST Protocol Reader
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it …
-
High 8.8
FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the f…
-
High 8.8
FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers ca…
-
High 8.8
FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_…
-
High 8.8
FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a…
-
High 8.1
FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragm…
-
High 7.8
FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tds…
-
High 7.8
FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without boun…
-
High 7.8
FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_f…
-
High 7.8
FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a…
-
High 7.8
FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflo…
-
High 7.8
FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c
FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive …
-
High 7.8
FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-…
-
High 7.5
FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fail…
-
High 7.1
FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. …
References
-
report
https://ubuntu.com/security/CVE-2026-64830
-
report
https://ubuntu.com/security/CVE-2026-64831
-
report
https://ubuntu.com/security/CVE-2026-64832
-
report
https://ubuntu.com/security/CVE-2026-64833
-
report
https://ubuntu.com/security/CVE-2026-64834
-
report
https://ubuntu.com/security/CVE-2026-64835
-
report
https://ubuntu.com/security/CVE-2026-65703
-
report
https://ubuntu.com/security/CVE-2026-65704
-
report
https://ubuntu.com/security/CVE-2026-65705
-
report
https://ubuntu.com/security/CVE-2026-65706
-
report
https://ubuntu.com/security/CVE-2026-75141
-
report
https://ubuntu.com/security/CVE-2026-75142
-
report
https://ubuntu.com/security/CVE-2026-75143
-
report
https://ubuntu.com/security/CVE-2026-75144
-
report
https://ubuntu.com/security/CVE-2026-75146