Advisorymedium
USN-8716-2: FFmpeg vulnerabilities
AI summary · glm-5.3-flashSummaries by Vani AI
Ubuntu issued USN-8716-2 fixing FFmpeg VobSub, Vulkan HEVC, and NVDEC decoder flaws that could allow denial of service or code execution.
USN-8716-2 provides the Ubuntu 26.04 LTS counterpart to the FFmpeg fixes in USN-8716-1. Crafted media files could cause denial of service or arbitrary code execution through the VobSub subtitle demuxer (CVE-2026-64830), the Vulkan HEVC hardware decoder (CVE-2026-64831), and the NVDEC video decoder path.
Key facts
- Extends USN-8716-1 FFmpeg fixes to Ubuntu 26.04 LTS
- CVE-2026-64830: crafted VobSub files can crash FFmpeg or execute code
- CVE-2026-64831: crafted HEVC bitstreams trigger Vulkan decoder flaws
- NVDEC decoder flaw also addressed with DoS or code-execution impact
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-64831+1 related CVE | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite… | 8.7 | <1% |
From the original article
USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides the corresponding fix for Ubuntu 26. 04 LTS.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.