OESA-2026-3467

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3467
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3467.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3467
Upstream
Published
2026-08-20T10:00:36Z
Modified
2026-08-20T10:15:15.029845926Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
ffmpeg security update
Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rsccdecodeframe() calls avimagecopyplane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflatedbuf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.(CVE-2026-70629)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/openEuler/ffmpeg&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.1-42.oe2403sp3

Ecosystem specific 

{
    "x86_64": [
        "ffmpeg-6.1.1-42.oe2403sp3.x86_64.rpm",
        "ffmpeg-debuginfo-6.1.1-42.oe2403sp3.x86_64.rpm",
        "ffmpeg-debugsource-6.1.1-42.oe2403sp3.x86_64.rpm",
        "ffmpeg-devel-6.1.1-42.oe2403sp3.x86_64.rpm",
        "ffmpeg-libs-6.1.1-42.oe2403sp3.x86_64.rpm",
        "libavdevice-6.1.1-42.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "ffmpeg-6.1.1-42.oe2403sp3.aarch64.rpm",
        "ffmpeg-debuginfo-6.1.1-42.oe2403sp3.aarch64.rpm",
        "ffmpeg-debugsource-6.1.1-42.oe2403sp3.aarch64.rpm",
        "ffmpeg-devel-6.1.1-42.oe2403sp3.aarch64.rpm",
        "ffmpeg-libs-6.1.1-42.oe2403sp3.aarch64.rpm",
        "libavdevice-6.1.1-42.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "ffmpeg-6.1.1-42.oe2403sp3.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3467.json"