Описание
Security update for ffmpeg-4
This update for ffmpeg-4 fixes the following issues:
Update to release 4.4.8.
- CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution (bsc#1269490).
- CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).
- CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution (bsc#1272752).
- CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption (bsc#1272754).
- CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory corruption (bsc#1272758).
- CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information disclosure (bsc#1272768).
- CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code execution (bsc#1272765).
Other updates and bugfixes:
- Release 4.4.8
- Various bug fixes to codecs
- avcodec/magicyuv: Fix 1 line MEDIAN slices
- avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
- avcodec/magicyuv: reject slice_height misaligned with chroma vshift
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
Ссылки
- Link for SUSE-SU-2026:3529-1
- E-Mail link for SUSE-SU-2026:3529-1
- SUSE Security Ratings
- SUSE Bug 1268595
- SUSE Bug 1269490
- SUSE Bug 1272752
- SUSE Bug 1272754
- SUSE Bug 1272758
- SUSE Bug 1272765
- SUSE Bug 1272768
- SUSE CVE CVE-2026-12706 page
- SUSE CVE CVE-2026-64830 page
- SUSE CVE CVE-2026-64832 page
- SUSE CVE CVE-2026-64835 page
- SUSE CVE CVE-2026-66038 page
- SUSE CVE CVE-2026-66039 page
- SUSE CVE CVE-2026-8461 page
Описание
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Затронутые продукты
Ссылки
- CVE-2026-12706
- SUSE Bug 1268595
Описание
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.
Затронутые продукты
Ссылки
- CVE-2026-64830
- SUSE Bug 1272752
Описание
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.
Затронутые продукты
Ссылки
- CVE-2026-64832
- SUSE Bug 1272754
Описание
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.
Затронутые продукты
Ссылки
- CVE-2026-64835
- SUSE Bug 1272758
Описание
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
Затронутые продукты
Ссылки
- CVE-2026-66038
- SUSE Bug 1272768
Описание
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.
Затронутые продукты
Ссылки
- CVE-2026-66039
- SUSE Bug 1272765
Описание
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
Затронутые продукты
Ссылки
- CVE-2026-8461
- SUSE Bug 1269490