ECHO-f2c1-328c-2bc2
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-f2c1-328c-2bc2.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-f2c1-328c-2bc2
- Upstream
- Withdrawn
- 2026-09-27T11:01:28Z
- Published
- 2026-07-25T20:57:01Z
- Modified
- 2026-09-27T11:45:05Z
- Summary
- Vulnerability is in libavfilter/vf_quirc.c (QR decode via libquirc). Debian's ffmpeg package does not enable --enable-libquirc (default off; not present in debian/rules CONFIG), so the quirc filter is not built into our binary. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66041 - https://github.com/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 details: | Upstream fix resizes quirc buffers when input size changes. Clean upstream patch applies to the source tree, but the filter is not compiled in. If --enable-libquirc is ever added to debian/rules, convert this to a real PATCH_TYPE_UPSTREAM_PATCH entry.
- Details
- References