kritisch
CVE-2026-40962
FFmpeg: FFmpeg: Integer overflow and out-of-bounds write via CENC subsample data
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.8CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Julia. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | FFMPEG_jll, FFMPEG_nogpl_jll, FFplay_jll | 8.1.0+0 und 1 weitere |
| chainguard | ffmpeg-6, ffmpeg-7.1, ffmpeg-8.0 und 2 weitere | 6.1.4-r4 und 4 weitere |
| debian 11 | ffmpeg | kein Fix angegeben |
| debian 12 | ffmpeg | 7:5.1.9-0+deb12u1 |
| debian 13 | ffmpeg | 7:7.1.4-0+deb13u1 |
| debian 14 | ffmpeg | 7:8.1-1 |
| echo | ffmpeg | 7:5.1.9-0+deb12u1 |
| rapidfort debian 12 | ffmpeg, rf-ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort debian 13 | ffmpeg, rf-ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort fedora 43 | ffmpeg, ffmpeg-free, ffmpeg-free-devel und 16 weitere | 0:7.1.4-1.fc43 und 1 weitere |
| root.io debian 11 | rootio-ffmpeg | kein Fix angegeben |
| root.io debian 12 | rootio-ffmpeg | 7:5.1.9-0+deb12u1 |
Alle 45 Einträge aus 18 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | FFMPEG_jll | 8.1.0+0 |
| julia::Julia Ecosystem Security Advisories | FFMPEG_nogpl_jll | 8.1.0+0 |
| julia::Julia Ecosystem Security Advisories | FFplay_jll | 8.1.2+0 |
| chainguard | ffmpeg-6 | 6.1.4-r4 |
| chainguard | ffmpeg-7.1 | 7.1.5-r2 |
| chainguard | ffmpeg-8.0 | 8.0.1-r7 |
| chainguard | ffmpeg-fips-7.1 | 7.1.4-r0 |
| chainguard | ffmpeg-fips-8.0 | 8.0.2-r0 |
| debian 11 | ffmpeg | kein Fix angegeben |
| debian 12 | ffmpeg | 7:5.1.9-0+deb12u1 |
| debian 13 | ffmpeg | 7:7.1.4-0+deb13u1 |
| debian 14 | ffmpeg | 7:8.1-1 |
| echo | ffmpeg | 7:5.1.9-0+deb12u1 |
| rapidfort debian 12 | ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort debian 12 | rf-ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort debian 13 | ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort debian 13 | rf-ffmpeg | 0:7.1.4-0+deb13u1, 7:8.1-1 |
| rapidfort fedora 43 | ffmpeg | 0:7.1.4-1.fc43 |
| rapidfort fedora 43 | ffmpeg-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | ffmpeg-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavcodec-free | 0:7.1.4-1.fc43 |
| rapidfort fedora 43 | libavcodec-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavdevice-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavdevice-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavfilter-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavfilter-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavformat-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavformat-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libavutil-free | 0:7.1.4-1.fc43 |
| rapidfort fedora 43 | libavutil-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libpostproc-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libpostproc-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libswresample-free | 0:7.1.4-1.fc43 |
| rapidfort fedora 43 | libswresample-free-devel | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libswscale-free | 7.1.4-1.fc43 |
| rapidfort fedora 43 | libswscale-free-devel | 7.1.4-1.fc43 |
| root.io debian 11 | rootio-ffmpeg | kein Fix angegeben |
| root.io debian 12 | rootio-ffmpeg | 7:5.1.9-0+deb12u1 |
| ubuntu 20.04-ESM | ffmpeg | 7:4.2.7-0ubuntu0.1+esm13 |
| ubuntu 22.04 | ffmpeg | kein Fix angegeben |
| ubuntu 24.04 | ffmpeg | kein Fix angegeben |
| ubuntu 26.04 | ffmpeg | kein Fix angegeben |
| ubuntu 26.10 | ffmpeg | kein Fix angegeben |
| wolfi | ffmpeg-7.1 | 7.1.5-r2 |
| wolfi | ffmpeg-8.0 | 8.0.1-r7 |