{"id":"MGASA-2026-0398","summary":"Updated ffmpeg package fixes security vulnerabilities","details":"Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)\nHeap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)\nDouble-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)\nOut-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)\nInfinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)\nOut-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)\nOut-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)\nOut-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)\nvf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)\nvf_swaprect Out-of-Bounds Write via NV12 Frame Processing.\n(CVE-2026-65706)\nHeap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)\nIAMF Demuxer Uncontrolled Resource Consumption via\nmix_presentation_obu(). (CVE-2026-66037)\nLCL/ZLIB Video Decoder Information Disclosure via lcldec.c.\n(CVE-2026-66038)\nMACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.\n(CVE-2026-66039)\nHeap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)\nDVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)\nUninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)\nUninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)\nUninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)\nHeap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.\n(CVE-2026-70632)\nHeap Buffer Overflow in hvcC Box Writer via HEVC Muxing.\n(CVE-2026-75141)\nStack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)\nHeap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)\nHeap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)\nOut-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)\n","modified":"2026-09-13T05:45:03.319490061Z","published":"2026-09-13T05:39:56Z","upstream":["CVE-2026-58049","CVE-2026-64830","CVE-2026-64832","CVE-2026-64833","CVE-2026-64834","CVE-2026-64835","CVE-2026-65703","CVE-2026-65704","CVE-2026-65705","CVE-2026-65706","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66039","CVE-2026-66041","CVE-2026-70628","CVE-2026-70629","CVE-2026-70630","CVE-2026-70631","CVE-2026-70632","CVE-2026-75141","CVE-2026-75142","CVE-2026-75143","CVE-2026-75144","CVE-2026-75146"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0398.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36272"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/"}],"affected":[{"package":{"name":"ffmpeg","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/ffmpeg?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0398.json"}},{"package":{"name":"ffmpeg","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/ffmpeg?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1.1.mga10.tainted"}]}],"ecosystem_specific":{"section":"tainted"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0398.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}