USN-8738-1: FFmpeg vulnerabilities
Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.
Ubuntu Security Notice USN-8738-1 addresses several FFmpeg flaws. CVE-2026-66036 involves mishandled video frames in the hqdn3d filter, allowing denial of service or arbitrary code execution. CVE-2026-66038, found by Adrian Junge, leaks sensitive information via compressed video files, and CVE-2026-66039 allows denial of service or code execution through crafted audio files. Additional subtitle-file handling flaws were also fixed.
- Multiple FFmpeg flaws fixed in Ubuntu
- CVE-2026-66036: hqdn3d filter DoS or code execution
- CVE-2026-66038: information disclosure via compressed video
- CVE-2026-66039: audio file DoS or code execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-66039 | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution. NVD description · AI analysis pending | 8.7 group max | <1% |
| — |
It was discovered that FFmpeg incorrectly handled certain video frames when using the hqdn3d filter. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-66036) Adrian Junge discovered that FFmpeg incorrectly handled certain compressed video files. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-66038) Adrian Junge discovered that FFmpeg incorrectly handled certain audio files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-66039) Adrian Junge discovered that FFmpeg incorrectly handled certain subtitle files. An attacker could possibly use…
This source does not provide full text. Read it at ubuntu.com.