USN-8750-1: FFmpeg vulnerabilities
Ubuntu USN-8750-1 fixes multiple FFmpeg memory-handling flaws that allow denial of service via crafted files.
Ubuntu Security Notice USN-8750-1 patches several FFmpeg vulnerabilities related to incorrect memory operations, reported by Seung Min Shin, Xinghang Lv, and others. If a user or automated system is tricked into opening a specially crafted file, an attacker could cause a denial of service. Affected CVEs include CVE-2026-12706, CVE-2026-30999, and CVE-2026-58049.
- Multiple FFmpeg memory-handling flaws patched in Ubuntu USN-8750-1
- Crafted files could trigger denial of service for users or automated systems
- Includes CVE-2026-12706, CVE-2026-30999, CVE-2026-58049
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12706 | FFmpeg's RASC video decoder: The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same… | 6.5 | <1% | ||
| CVE-2026-30999 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input | 7.5 | <1% | PoC | |
| CVE-2026-58049 | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and… | 8.8 | <1% |
From the original article
Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-12706) Xinghang Lv discovered that FFmpeg did not correctly handle certain memory operations.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.