OESA-2026-3471

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3471

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3471.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-3471

Upstream

CVE-2026-70629

Published

2026-08-20T10:00:44Z

Modified

2026-08-20T10:15:05.006651687Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

ffmpeg security update

Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rsccdecodeframe() calls avimagecopyplane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflatedbuf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.(CVE-2026-70629)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP1 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:rpm/openEuler/ffmpeg&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1.1-42.oe2403sp1

Ecosystem specific

{
    "x86_64": [
        "ffmpeg-6.1.1-42.oe2403sp1.x86_64.rpm",
        "ffmpeg-debuginfo-6.1.1-42.oe2403sp1.x86_64.rpm",
        "ffmpeg-debugsource-6.1.1-42.oe2403sp1.x86_64.rpm",
        "ffmpeg-devel-6.1.1-42.oe2403sp1.x86_64.rpm",
        "ffmpeg-libs-6.1.1-42.oe2403sp1.x86_64.rpm",
        "libavdevice-6.1.1-42.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "ffmpeg-6.1.1-42.oe2403sp1.src.rpm"
    ],
    "aarch64": [
        "ffmpeg-6.1.1-42.oe2403sp1.aarch64.rpm",
        "ffmpeg-debuginfo-6.1.1-42.oe2403sp1.aarch64.rpm",
        "ffmpeg-debugsource-6.1.1-42.oe2403sp1.aarch64.rpm",
        "ffmpeg-devel-6.1.1-42.oe2403sp1.aarch64.rpm",
        "ffmpeg-libs-6.1.1-42.oe2403sp1.aarch64.rpm",
        "libavdevice-6.1.1-42.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3471.json"