Summary
Seung Min Shin discovered that FFmpeg did not correctly handle certain
memory operations. If a user or automated system were tricked into
opening a specially crafted file, an attacker could cause a denial of
service. (CVE-2026-12706)
Xinghang Lv discovered that FFmpeg did not correctly handle certain
memory operations. If a user or automated system were tricked into
opening a specially crafted file, an attacker could cause a denial of
service. (CVE-2026-30999)
It was discovered that FFmpeg did not correctly handle certain memory
operations. If a user or automated system were tricked into opening a
specially crafted file, an attacker could cause a denial of service.
(CVE-2026-58049)
Adrian Junge discovered that FFmpeg did not correctly handle certain
memory operations. If a user or automated system were tricked into
opening a specially crafted file, an attacker could leak sensitive
information. (CVE-2026-70629, CVE-2026-70630, CVE-2026-70631)
Ori Hollander discovered that FFmpeg did not correctly handle certain
memory operations. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly cause a
denial of service or execute arbitrary code. (CVE-2026-8461)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm17 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm16 |
Vulnerabilities 7
-
High 8.8CVE-2026-8461 Public exploit
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magic…
-
High 8.6
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access s…
-
High 7.5
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Serv…
-
Medium 6.5
Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangli…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compr…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV…
-
Medium 5.5
FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-com…
References
-
report
https://ubuntu.com/security/CVE-2026-8461
-
report
https://ubuntu.com/security/CVE-2026-12706
-
report
https://ubuntu.com/security/CVE-2026-30999
-
report
https://ubuntu.com/security/CVE-2026-58049
-
report
https://ubuntu.com/security/CVE-2026-70629
-
report
https://ubuntu.com/security/CVE-2026-70630
-
report
https://ubuntu.com/security/CVE-2026-70631