OESA-2026-3469

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3469
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3469.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3469
Upstream
Published
2026-08-20T10:00:40Z
Modified
2026-08-20T10:15:14.644306608Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
ffmpeg security update
Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A flaw was found in FFmpeg s TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.(CVE-2023-6602)

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rsccdecodeframe() calls avimagecopyplane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflatedbuf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.(CVE-2026-70629)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP4 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/openEuler/ffmpeg&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.4-48.oe2003sp4

Ecosystem specific 

{
    "x86_64": [
        "ffmpeg-4.2.4-48.oe2003sp4.x86_64.rpm",
        "ffmpeg-debuginfo-4.2.4-48.oe2003sp4.x86_64.rpm",
        "ffmpeg-debugsource-4.2.4-48.oe2003sp4.x86_64.rpm",
        "ffmpeg-devel-4.2.4-48.oe2003sp4.x86_64.rpm",
        "ffmpeg-libs-4.2.4-48.oe2003sp4.x86_64.rpm",
        "libavdevice-4.2.4-48.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "ffmpeg-4.2.4-48.oe2003sp4.aarch64.rpm",
        "ffmpeg-debuginfo-4.2.4-48.oe2003sp4.aarch64.rpm",
        "ffmpeg-debugsource-4.2.4-48.oe2003sp4.aarch64.rpm",
        "ffmpeg-devel-4.2.4-48.oe2003sp4.aarch64.rpm",
        "ffmpeg-libs-4.2.4-48.oe2003sp4.aarch64.rpm",
        "libavdevice-4.2.4-48.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "ffmpeg-4.2.4-48.oe2003sp4.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3469.json"