Home / mailings

PDF

[USN-8716-2] FFmpeg vulnerabilities

Posted on 10 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8716-2
September 09, 2026

ffmpeg vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

FFmpeg could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
- ffmpeg: Tools for transcoding, streaming and playing of multimedia files

Details:

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides
the corresponding fix for Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)

It was discovered that FFmpeg incorrectly handled certain crafted HEVC
bitstreams in the Vulkan HEVC hardware decoder. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-64831)

It was discovered that FFmpeg incorrectly handled certain crafted video
files in the NVDEC hardware decoder. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64832)

It was discovered that FFmpeg incorrectly handled certain crafted DTS
audio streams in the S/PDIF muxer. An attacker could possibly use this
issue to cause a denial of service or expose sensitive information.
(CVE-2026-64833)

It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-64834)

It was discovered that FFmpeg incorrectly handled certain crafted ADX
audio files. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-64835)

It was discovered that FFmpeg incorrectly handled certain crafted AVI
files in the TDSC video decoder. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65703)

It was discovered that FFmpeg incorrectly handled certain crafted
ffconcat files processed via the TY demuxer. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65704)

It was discovered that FFmpeg incorrectly handled certain crafted video
streams in the vf_floodfill video filter. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65705)

It was discovered that FFmpeg incorrectly handled certain crafted NV12
video frames in the vf_swaprect video filter. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-65706)

It was discovered that FFmpeg incorrectly handled certain crafted hvcC
NAL arrays in the HEVC parser. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75141)

It was discovered that FFmpeg incorrectly handled certain crafted MPEG
system headers. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-75142)

It was discovered that FFmpeg incorrectly handled certain crafted
network input in the librist protocol handler. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-75143)

It was discovered that FFmpeg incorrectly handled certain crafted Dirac
data units in the VC2 HQ RTP packetizer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75144)

It was discovered that FFmpeg incorrectly handled certain crafted DASH
manifests. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2026-75146)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
ffmpeg 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro
libavcodec-extra62 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro
libavcodec62 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro
libavfilter11 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro
libavformat-extra62 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro
libavformat62 7:8.0.1-3ubuntu2+esm4
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8716-2
https://ubuntu.com/security/notices/USN-8716-1
CVE-2026-64830, CVE-2026-64831, CVE-2026-64832, CVE-2026-64833,
CVE-2026-64834, CVE-2026-64835, CVE-2026-65703, CVE-2026-65704,
CVE-2026-65705, CVE-2026-65706, CVE-2026-75141, CVE-2026-75142,
CVE-2026-75143, CVE-2026-75144, CVE-2026-75146

--===============4767768723599121452==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP