Description
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:7.0.1-3 | — |
| Debian 13 | ffmpeg | 7:7.0.1-3 | — |
| Debian 12 | ffmpeg | 7:5.1.5-0+deb12u1 | DSA-5712-1 |
| Debian 11 | ffmpeg | 7:4.3.7-0+deb11u1 | DSA-5721-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm5 | USN-7823-1 |
| Ubuntu Pro 22.04 LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm9 | USN-7823-1 |
| Ubuntu Pro 20.04 LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm10 | USN-7823-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm10 | USN-7823-1 |
| Ubuntu Pro 16.04 LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm12 | USN-7823-1 |
| Ubuntu Pro 14.04 LTS | libav | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ffmpeg-4 | 4.4.7-150600.13.47.1 | SUSE-SU-2026:2445-1 |
| SLES 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
| SLE HPC 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ffmpeg-4 | 4.4.7-2.1 | openSUSE-SU-2026:10866-1 |
| openSUSE Tumbleweed | ffmpeg-7 | 7.1.4-2.1 | openSUSE-SU-2026:10867-1 |
| openSUSE Leap 16.0 | ffmpeg-7 | 7.1.4-160000.1.1 | openSUSE-SU-2026:21211-1 |
Advisories 9
- WID-SEC-2024-3572 ffmpeg: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 19, 2026
- openSUSE-SU-2026:21211-1 Security update for ffmpeg-7 SUSE / openSUSE Security Updates · Jul 3, 2026
- USN-7823-1 ffmpeg vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2026:2444-1 Security update for ffmpeg-4 SUSE / openSUSE Security Updates · Jun 19, 2026
- SUSE-SU-2026:2445-1 Security update for ffmpeg-4 SUSE / openSUSE Security Updates · Jun 19, 2026
- openSUSE-SU-2026:10867-1 ffmpeg-7-7.1.4-2.1 on GA media SUSE / openSUSE Security Updates · May 28, 2026
- openSUSE-SU-2026:10866-1 ffmpeg-4-4.4.7-2.1 on GA media SUSE / openSUSE Security Updates · May 28, 2026
- DSA-5721-1 ffmpeg - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5712-1 ffmpeg - security update Debian Security (DSA / DLA) · Mar 9, 2026