OESA-2026-4144

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4144
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-4144.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-4144
Upstream
CVE (3)
Published
2026-09-30T13:47:01Z
Modified
2026-10-01T02:00:05Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ffmpeg security update
Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)

Database specific 
{
    "severity":  "High"
}
References

Affected packages

openEuler:22.03-LTS-SP4 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:rpm/openEuler/ffmpeg&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.2.4-57.oe2203sp4

Ecosystem specific 

{
    "aarch64":  [
        "ffmpeg-4.2.4-57.oe2203sp4.aarch64.rpm",
        "ffmpeg-debuginfo-4.2.4-57.oe2203sp4.aarch64.rpm",
        "ffmpeg-debugsource-4.2.4-57.oe2203sp4.aarch64.rpm",
        "ffmpeg-devel-4.2.4-57.oe2203sp4.aarch64.rpm",
        "ffmpeg-libs-4.2.4-57.oe2203sp4.aarch64.rpm",
        "libavdevice-4.2.4-57.oe2203sp4.aarch64.rpm"
    ],
    "src":  [
        "ffmpeg-4.2.4-57.oe2203sp4.src.rpm"
    ],
    "x86_64":  [
        "ffmpeg-4.2.4-57.oe2203sp4.x86_64.rpm",
        "ffmpeg-debuginfo-4.2.4-57.oe2203sp4.x86_64.rpm",
        "ffmpeg-debugsource-4.2.4-57.oe2203sp4.x86_64.rpm",
        "ffmpeg-devel-4.2.4-57.oe2203sp4.x86_64.rpm",
        "ffmpeg-libs-4.2.4-57.oe2203sp4.x86_64.rpm",
        "libavdevice-4.2.4-57.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4144.json"