{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"ffmpeg security update", "category":"general", "title":"Synopsis" }, { "text":"An update for ffmpeg is now available for openEuler-22.03-LTS-SP4", "category":"general", "title":"Summary" }, { "text":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\n\nSecurity Fix(es):\n\nAn improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.(CVE-2026-30998)\n\nFFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.(CVE-2026-58049)\n\nFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.(CVE-2026-64830)\n\nFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.(CVE-2026-64833)\n\nFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.(CVE-2026-64834)\n\nFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.(CVE-2026-65704)\n\nFFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.(CVE-2026-65706)\n\nFFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.(CVE-2026-66036)\n\nFFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.(CVE-2026-66039)\n\nFFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.(CVE-2026-70630)\n\nFFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.(CVE-2026-75141)\n\nFFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.(CVE-2026-75142)\n\nFFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.(CVE-2026-75144)\n\nFFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.(CVE-2026-75146)", "category":"general", "title":"Description" }, { "text":"An update for ffmpeg is now available for openEuler-22.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"ffmpeg", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-3541", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" }, { "summary":"CVE-2026-30998", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-30998&packageName=ffmpeg" }, { "summary":"CVE-2026-58049", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58049&packageName=ffmpeg" }, { "summary":"CVE-2026-64830", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-64830&packageName=ffmpeg" }, { "summary":"CVE-2026-64833", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-64833&packageName=ffmpeg" }, { "summary":"CVE-2026-64834", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-64834&packageName=ffmpeg" }, { "summary":"CVE-2026-65704", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65704&packageName=ffmpeg" }, { "summary":"CVE-2026-65706", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65706&packageName=ffmpeg" }, { "summary":"CVE-2026-66036", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66036&packageName=ffmpeg" }, { "summary":"CVE-2026-66039", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66039&packageName=ffmpeg" }, { "summary":"CVE-2026-70630", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-70630&packageName=ffmpeg" }, { "summary":"CVE-2026-75141", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75141&packageName=ffmpeg" }, { "summary":"CVE-2026-75142", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75142&packageName=ffmpeg" }, { "summary":"CVE-2026-75144", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75144&packageName=ffmpeg" }, { "summary":"CVE-2026-75146", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75146&packageName=ffmpeg" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75141" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75142" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75144" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146" }, { "summary":"openEuler-SA-2026-3541 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-3541.json" } ], "title":"An update for ffmpeg is now available for openEuler-22.03-LTS-SP4", "tracking":{ "initial_release_date":"2026-09-02T09:27:06+08:00", "revision_history":[ { "date":"2026-09-02T09:27:06+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-02T09:27:06+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-02T09:27:06+08:00", "id":"openEuler-SA-2026-3541", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"openEuler-22.03-LTS-SP4", "name":"openEuler-22.03-LTS-SP4" }, "name":"openEuler-22.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"ffmpeg-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"ffmpeg-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"libavdevice-4.2.4-53.oe2203sp4.aarch64.rpm", "name":"libavdevice-4.2.4-53.oe2203sp4.aarch64.rpm" }, "name":"libavdevice-4.2.4-53.oe2203sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-4.2.4-53.oe2203sp4.src.rpm", "name":"ffmpeg-4.2.4-53.oe2203sp4.src.rpm" }, "name":"ffmpeg-4.2.4-53.oe2203sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"ffmpeg-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"ffmpeg-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"libavdevice-4.2.4-53.oe2203sp4.x86_64.rpm", "name":"libavdevice-4.2.4-53.oe2203sp4.x86_64.rpm" }, "name":"libavdevice-4.2.4-53.oe2203sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "name":"ffmpeg-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"libavdevice-4.2.4-53.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "name":"libavdevice-4.2.4-53.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-4.2.4-53.oe2203sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "name":"ffmpeg-4.2.4-53.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "name":"ffmpeg-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "name":"ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "name":"ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "name":"ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "name":"ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"libavdevice-4.2.4-53.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64", "name":"libavdevice-4.2.4-53.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-30998", "notes":[ { "text":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-30998" }, { "cve":"CVE-2026-58049", "notes":[ { "text":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-58049" }, { "cve":"CVE-2026-64830", "notes":[ { "text":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-64830" }, { "cve":"CVE-2026-64833", "notes":[ { "text":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.1, "vectorString":"CVSS:3.1/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-64833" }, { "cve":"CVE-2026-64834", "notes":[ { "text":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-64834" }, { "cve":"CVE-2026-65704", "notes":[ { "text":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-65704" }, { "cve":"CVE-2026-65706", "notes":[ { "text":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.5, "vectorString":"CVSS:3.1/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-65706" }, { "cve":"CVE-2026-66036", "notes":[ { "text":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-66036" }, { "cve":"CVE-2026-66039", "notes":[ { "text":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-66039" }, { "cve":"CVE-2026-70630", "notes":[ { "text":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.5, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-70630" }, { "cve":"CVE-2026-75141", "notes":[ { "text":"FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-75141" }, { "cve":"CVE-2026-75142", "notes":[ { "text":"FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-75142" }, { "cve":"CVE-2026-75144", "notes":[ { "text":"FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-75144" }, { "cve":"CVE-2026-75146", "notes":[ { "text":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3541" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.src", "openEuler-22.03-LTS-SP4:ffmpeg-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debuginfo-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-debugsource-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-devel-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:ffmpeg-libs-4.2.4-53.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:libavdevice-4.2.4-53.oe2203sp4.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-75146" } ] }