Description
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FFmpeg | 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 5.1.0, 5.1.1, … | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:7.1.2-1 | — |
| Debian 13 | ffmpeg | 7:7.1.2-0+deb13u1 | DSA-6007-1 |
| Debian 12 | ffmpeg | 7:5.1.8-0+deb12u1 | DSA-6079-1 |
| Debian 11 | ffmpeg | 7:4.3.9-0+deb11u2 | DLA-4440-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | ffmpeg | 7:7.1.1-1ubuntu4 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm4 | USN-7738-1 |
| Ubuntu Pro 22.04 LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm8 | USN-7738-1 |
| Ubuntu Pro 20.04 LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm9 | USN-7738-1 |
| Ubuntu Pro 18.04 LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm9 | USN-7738-1 |
| Ubuntu Pro 16.04 LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm11 | USN-7738-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ffmpeg-4 | 4.4.7-150600.13.47.1 | SUSE-SU-2026:2445-1 |
| SLES 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
| SLE HPC 15 SP4 | ffmpeg-4 | 4.4.7-150400.3.67.1 | SUSE-SU-2026:2444-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ffmpeg-4 | 4.4.7-2.1 | openSUSE-SU-2026:10866-1 |
| openSUSE Tumbleweed | ffmpeg-7 | 7.1.4-2.1 | openSUSE-SU-2026:10867-1 |
| openSUSE Tumbleweed | ffmpeg-8 | 8.1.1-3.1 | openSUSE-SU-2026:10890-1 |
| openSUSE Tumbleweed | ffmpeg-9 | 9.0.1-1.1 | openSUSE-SU-2026:11515-1 |
| openSUSE Leap 16.0 | ffmpeg-7 | 7.1.4-160000.1.1 | openSUSE-SU-2026:21211-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ffmpeg | 7.1.1-r0 | — |
| Alpine v3.23 | ffmpeg | 7.1.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ffmpeg-7 | 7.1.1-r12 | — |
Advisories 12
- WID-SEC-2025-0429 ffmpeg: Schwachstelle ermöglicht Denial of Service, potentiell Codeausführung BSI CERT-Bund (WID) · Aug 16, 2026
- openSUSE-SU-2026:11515-1 ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
- openSUSE-SU-2026:21211-1 Security update for ffmpeg-7 SUSE / openSUSE Security Updates · Jul 3, 2026
- USN-7738-1 ffmpeg vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2026:2444-1 Security update for ffmpeg-4 SUSE / openSUSE Security Updates · Jun 19, 2026
- SUSE-SU-2026:2445-1 Security update for ffmpeg-4 SUSE / openSUSE Security Updates · Jun 19, 2026
- openSUSE-SU-2026:10890-1 ffmpeg-8-8.1.1-3.1 on GA media SUSE / openSUSE Security Updates · May 30, 2026
- openSUSE-SU-2026:10867-1 ffmpeg-7-7.1.4-2.1 on GA media SUSE / openSUSE Security Updates · May 28, 2026
- openSUSE-SU-2026:10866-1 ffmpeg-4-4.4.7-2.1 on GA media SUSE / openSUSE Security Updates · May 28, 2026
- DSA-6007-1 ffmpeg - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-6079-1 ffmpeg - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4440-1 ffmpeg - security update Debian Security (DSA / DLA) · Jan 17, 2026
References
- VDB-296589 | FFmpeg AAC Encoder aacenc_tns.c ff_aac_search_for_tns stack-based overflow vdb-entry technical-description
- VDB-296589 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #496929 | FFmpeg git master stack-buffer-overflow third-party-advisory
- https://trac.ffmpeg.org/ticket/11418#comment:3 issue-tracking
- https://trac.ffmpeg.org/attachment/ticket/11418/poc exploit issue-tracking
- https://ffmpeg.org/ product