1. Ubuntu Security Notices
  2. USN-8716-2

USN-8716-2: FFmpeg vulnerabilities

Publication date

9 September 2026

Overview

FFmpeg could be made to crash or run programs as your login if it opened a specially crafted file.

Releases

Packages

  • ffmpeg - Tools for transcoding, streaming and playing of multimedia files

Details

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides
the corresponding fix for Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)

It was discovered that FFmpeg incorrectly handled certain crafted HEVC
bitstreams in the Vulkan HEVC hardware decoder. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-64831)

It was discovered that FFmpeg incorrectly handled certain crafted video
files in the NVDEC hardware decoder. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides
the corresponding fix for Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that FFmpeg incorrectly handled certain crafted media
files in the VobSub subtitle demuxer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64830)

It was discovered that FFmpeg incorrectly handled certain crafted HEVC
bitstreams in the Vulkan HEVC hardware decoder. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-64831)

It was discovered that FFmpeg incorrectly handled certain crafted video
files in the NVDEC hardware decoder. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-64832)

It was discovered that FFmpeg incorrectly handled certain crafted DTS
audio streams in the S/PDIF muxer. An attacker could possibly use this
issue to cause a denial of service or expose sensitive information.
(CVE-2026-64833)

It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-64834)

It was discovered that FFmpeg incorrectly handled certain crafted ADX
audio files. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-64835)

It was discovered that FFmpeg incorrectly handled certain crafted AVI
files in the TDSC video decoder. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65703)

It was discovered that FFmpeg incorrectly handled certain crafted
ffconcat files processed via the TY demuxer. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65704)

It was discovered that FFmpeg incorrectly handled certain crafted video
streams in the vf_floodfill video filter. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-65705)

It was discovered that FFmpeg incorrectly handled certain crafted NV12
video frames in the vf_swaprect video filter. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-65706)

It was discovered that FFmpeg incorrectly handled certain crafted hvcC
NAL arrays in the HEVC parser. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75141)

It was discovered that FFmpeg incorrectly handled certain crafted MPEG
system headers. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-75142)

It was discovered that FFmpeg incorrectly handled certain crafted
network input in the librist protocol handler. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-75143)

It was discovered that FFmpeg incorrectly handled certain crafted Dirac
data units in the VC2 HQ RTP packetizer. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-75144)

It was discovered that FFmpeg incorrectly handled certain crafted DASH
manifests. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2026-75146)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute ffmpeg –  7:8.0.1-3ubuntu2+esm4  
libavcodec-extra62 –  7:8.0.1-3ubuntu2+esm4  
libavcodec62 –  7:8.0.1-3ubuntu2+esm4  
libavfilter11 –  7:8.0.1-3ubuntu2+esm4  
libavformat-extra62 –  7:8.0.1-3ubuntu2+esm4  
libavformat62 –  7:8.0.1-3ubuntu2+esm4  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›