Описание
Security update for ffmpeg-7
This update for ffmpeg-7 fixes the following issues:
- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (bsc#1234029).
- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while (bsc#1234017).
- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c (bsc#1237382).
- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).
- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).
- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption (bsc#1269550).
- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).
- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).
- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).
- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).
- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).
- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).
- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).
- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).
Changes for ffmpeg-7:
Update to version 7.1.5:
- Various crash, out-of-bounds access, add boundary check fixes. Affected: .mov parser, DASH parser, Snow encoder, Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech, ADPCM, Matroska decoder
- avcodec/jpeg2000dec: clear array length when freeing it (CVE-2025-22921, bsc#1237382)
- avcodec/magicyuv: Fix 1 line MEDIAN slices (CVE-2026-8461, bsc#1269490)
- avcodec/magicyuv: reject slice_height misaligned with chroma vshift.
- avcodec/magicyuv: Expand the s->interlaced slice-height sanity check.
- avcodec/rasc: fix heap use-after-free in decode_move(). (CVE-2026-12706, bsc#1268595)
- avformat/hls: Be more picky on extensions. (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)
- lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so a thread for vp9 decoding might get stuck. (CVE-2024-36615, bsc#1234017).
- avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585) (CVE-2024-36615, bsc#1234017)
- lavc/vp9: Fix regression introduced in 0ba0585.
- avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6. (CVE-2024-35367, bsc#1234029)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1220546
- SUSE Bug 1220549
- SUSE Bug 1234017
- SUSE Bug 1234029
- SUSE Bug 1237382
- SUSE Bug 1268595
- SUSE Bug 1269490
- SUSE Bug 1269550
- SUSE Bug 1272755
- SUSE Bug 1272757
- SUSE Bug 1272759
- SUSE Bug 1272760
- SUSE Bug 1272761
- SUSE Bug 1272762
- SUSE Bug 1272763
- SUSE Bug 1272764
- SUSE Bug 1274268
- SUSE Bug 1274270
- SUSE Bug 1274282
Описание
A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.
Затронутые продукты
Ссылки
- CVE-2023-6602
- SUSE Bug 1220546
Описание
A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.
Затронутые продукты
Ссылки
- CVE-2023-6604
- SUSE Bug 1220549
Описание
FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer
Затронутые продукты
Ссылки
- CVE-2024-35367
- SUSE Bug 1234029
Описание
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.
Затронутые продукты
Ссылки
- CVE-2024-36615
- SUSE Bug 1234017
Описание
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.
Затронутые продукты
Ссылки
- CVE-2025-22921
- SUSE Bug 1237382
Описание
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Затронутые продукты
Ссылки
- CVE-2026-12706
- SUSE Bug 1268595
Описание
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
Затронутые продукты
Ссылки
- CVE-2026-58049
- SUSE Bug 1269550
Описание
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.
Затронутые продукты
Ссылки
- CVE-2026-64833
- SUSE Bug 1272755
Описание
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
Затронутые продукты
Ссылки
- CVE-2026-64834
- SUSE Bug 1272757
Описание
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.
Затронутые продукты
Ссылки
- CVE-2026-65703
- SUSE Bug 1272759
Описание
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
Затронутые продукты
Ссылки
- CVE-2026-65704
- SUSE Bug 1272760
Описание
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
Затронутые продукты
Ссылки
- CVE-2026-65705
- SUSE Bug 1272761
Описание
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.
Затронутые продукты
Ссылки
- CVE-2026-65706
- SUSE Bug 1272762
Описание
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.
Затронутые продукты
Ссылки
- CVE-2026-66036
- SUSE Bug 1272763
Описание
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Затронутые продукты
Ссылки
- CVE-2026-66037
- SUSE Bug 1272764
Описание
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.
Затронутые продукты
Ссылки
- CVE-2026-70628
- SUSE Bug 1274268
Описание
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.
Затронутые продукты
Ссылки
- CVE-2026-70629
- SUSE Bug 1274270
Описание
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.
Затронутые продукты
Ссылки
- CVE-2026-70630
- SUSE Bug 1274282
Описание
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.
Затронутые продукты
Ссылки
- CVE-2026-70631
- SUSE Bug 1274287
Описание
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
Затронутые продукты
Ссылки
- CVE-2026-70632
- SUSE Bug 1274289
Описание
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.
Затронутые продукты
Ссылки
- CVE-2026-75141
- SUSE Bug 1276407
Описание
FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.
Затронутые продукты
Ссылки
- CVE-2026-75142
- SUSE Bug 1276408
Описание
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
Затронутые продукты
Ссылки
- CVE-2026-75143
- SUSE Bug 1276409
Описание
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
Затронутые продукты
Ссылки
- CVE-2026-75144
- SUSE Bug 1276410
Описание
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.
Затронутые продукты
Ссылки
- CVE-2026-75146
- SUSE Bug 1276412
Описание
An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
Затронутые продукты
Ссылки
- CVE-2026-8461
- SUSE Bug 1269490