Home / mailings [USN-8716-1] FFmpeg vulnerabilities
Posted on 03 September 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8716-1
September 03, 2026
Several security issues were fixed in FFmpeg.
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
FFmpeg could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- ffmpeg: Tools for transcoding, streaming and playing of multimedia files
Details:
It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)
It was discovered that FFmpeg incorrectly handled certain crafted DTS
audio streams in the S/PDIF muxer. An attacker could possibly use this
issue to cause a denial of service or expose sensitive information.
(CVE-2026-64833)
It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-64834)
It was discovered that FFmpeg incorrectly handled certain crafted ADX
audio files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2026-64835)
It was discovered that FFmpeg incorrectly handled certain crafted AVI
files in the TDSC video decoder. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65703)
It was discovered that FFmpeg incorrectly handled certain crafted
ffconcat files processed via the TY demuxer. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2026-65704)
It was discovered that FFmpeg incorrectly handled certain crafted video
streams in the vf_floodfill video filter. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04
LTS. (CVE-2026-65705)
It was discovered that FFmpeg incorrectly handled certain crafted NV12
video frames in the vf_swaprect video filter. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04
LTS. (CVE-2026-65706)
It was discovered that FFmpeg incorrectly handled certain crafted hvcC
NAL arrays in the HEVC parser. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75141)
It was discovered that FFmpeg incorrectly handled certain crafted MPEG
system headers. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-75142)
It was discovered that FFmpeg incorrectly handled certain crafted
network input in the librist protocol handler. This issue only
affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143)
It was discovered that FFmpeg incorrectly handled certain crafted Dirac
data units in the VC2 HQ RTP packetizer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75144)
It was discovered that FFmpeg incorrectly handled certain crafted DASH
manifests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
ffmpeg 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
libavcodec-extra60 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
libavcodec60 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
libavfilter9 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
libavformat-extra60 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
libavformat60 7:6.1.1-3ubuntu5+esm13
Available with Ubuntu Pro
Ubuntu 22.04 LTS
ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
libavcodec-extra58 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
libavcodec58 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
libavfilter7 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
libavformat-extra58 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
libavformat58 7:4.4.2-0ubuntu0.22.04.1+esm15
Available with Ubuntu Pro
Ubuntu 20.04 LTS
ffmpeg 7:4.2.7-0ubuntu0.1+esm16
Available with Ubuntu Pro
libavcodec-extra58 7:4.2.7-0ubuntu0.1+esm16
Available with Ubuntu Pro
libavcodec58 7:4.2.7-0ubuntu0.1+esm16
Available with Ubuntu Pro
libavfilter7 7:4.2.7-0ubuntu0.1+esm16
Available with Ubuntu Pro
libavformat58 7:4.2.7-0ubuntu0.1+esm16
Available with Ubuntu Pro
Ubuntu 18.04 LTS
ffmpeg 7:3.4.11-0ubuntu0.1+esm15
Available with Ubuntu Pro
libavcodec-extra57 7:3.4.11-0ubuntu0.1+esm15
Available with Ubuntu Pro
libavcodec57 7:3.4.11-0ubuntu0.1+esm15
Available with Ubuntu Pro
libavfilter6 7:3.4.11-0ubuntu0.1+esm15
Available with Ubuntu Pro
libavformat57 7:3.4.11-0ubuntu0.1+esm15
Available with Ubuntu Pro
Ubuntu 16.04 LTS
ffmpeg 7:2.8.17-0ubuntu0.1+esm17
Available with Ubuntu Pro
libavcodec-ffmpeg-extra56 7:2.8.17-0ubuntu0.1+esm17
Available with Ubuntu Pro
libavcodec-ffmpeg56 7:2.8.17-0ubuntu0.1+esm17
Available with Ubuntu Pro
libavfilter-ffmpeg5 7:2.8.17-0ubuntu0.1+esm17
Available with Ubuntu Pro
libavformat-ffmpeg56 7:2.8.17-0ubuntu0.1+esm17
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8716-1
CVE-2026-64830, CVE-2026-64832, CVE-2026-64833, CVE-2026-64834,
CVE-2026-64835, CVE-2026-65703, CVE-2026-65704, CVE-2026-65705,
CVE-2026-65706, CVE-2026-75141, CVE-2026-75142, CVE-2026-75143,
CVE-2026-75144, CVE-2026-75146
--===============2401106610975385870==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
