USN-8738-1: FFmpeg vulnerabilities
Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.
Ubuntu Security Notice USN-8738-1 addresses several FFmpeg flaws. CVE-2026-66036 involves mishandled video frames in the hqdn3d filter, allowing denial of service or arbitrary code execution. CVE-2026-66038, found by Adrian Junge, leaks sensitive information via compressed video files, and CVE-2026-66039 allows denial of service or code execution through crafted audio files. Additional subtitle-file handling flaws were also fixed.
- Multiple FFmpeg flaws fixed in Ubuntu
- CVE-2026-66036: hqdn3d filter DoS or code execution
- CVE-2026-66038: information disclosure via compressed video
- CVE-2026-66039: audio file DoS or code execution
- Products
- FFmpeg
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-66039+2 related CVEs | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt… | 8.7 group max | <1% |
From the original article
It was discovered that FFmpeg incorrectly handled certain video frames when using the hqdn3d filter. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-66036) Adrian Junge discovered that FFmpeg incorrectly handled certain compressed video files.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.