CVE-2026-30997: ffmpeg Out-of-bounds Read
CVSS: 7.5v3.1HighAnalyzed
AliasesSUSE-SU-2026:22573-1UBUNTU-CVE-2026-30997DEBIAN-CVE-2026-30997CGA-344p-3c33-2rw2CGA-445v-8g5x-9x5rCGA-4mhv-ff5h-q549CGA-4rr6-fm96-4wcgCGA-5g9w-x86r-5pvwCGA-jc68-q943-chvxCGA-m2gg-8x9x-h74cCGA-xfgc-6vg2-g277openSUSE-SU-2026:10931-1openSUSE-SU-2026:11009-1openSUSE-SU-2026:21258-1CGA-38f8-8wh6-w692CGA-3rh5-6hq3-5g85CGA-49r9-698c-f6gpCGA-4jvc-xj79-cgvxCGA-5cwv-w39g-6fj8CGA-63c7-3vmg-cmf7CGA-6rcc-cphh-3gx4CGA-756g-xhxg-gmrfCGA-8xhf-3j54-rm77CGA-97pc-m38q-hc87CGA-cjxg-9xm5-4wwqCGA-fg4x-9hh2-87jjCGA-gfpp-qr8c-ffccCGA-hv6g-99j3-2wqrCGA-q7hw-7632-4f7fCGA-qv68-w8qr-pm99CGA-r2r2-v95q-75h5CGA-r8qj-476v-hjhmCGA-rrhr-97qh-xj96CGA-v9m3-f8r9-w67vCGA-w538-2qxx-3vcwCGA-xcjj-2vww-q968
Published 13-04-2026Last modified 13-04-2026
Vulnerability summary
CVE-2026-30997 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in ffmpeg. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.52%
0%100%
Low · +0.18 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 13-04-2026PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.18 pp
From 0.34% on 19-09-2026
19-09-202619-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (excellent-oatmeal-319.notion.site)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Wolfi5 products
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1< 7.1.3-r7
- ffmpeg-7.1-libavdevice61< 7.1.5-r2
- ffmpeg-7.1-libswscale8< 7.1.5-r2
- ffmpeg-8.0< 8.0.2-r0
Opensuse3 products
- ffmpeg-4&distro=openSUSE Tumbleweed< 4.4.7-3.1
- ffmpeg-7&distro=openSUSE Leap 16.0< 7.1.4-160000.2.1
- ffmpeg-7&distro=openSUSE Tumbleweed< 7.1.4-3.1
Suse2 products
- ffmpeg-7&distro=SUSE Linux Enterprise Server 16.0< 7.1.4-160000.2.1
- ffmpeg-7&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 7.1.4-160000.2.1
Ubuntu2 products
- ffmpegAll versions (No fix recorded)
- libavAll versions (No fix recorded)
Debian1 product
- ffmpeg< 7:5.1.9-0+deb12u1 | < 7:7.1.5-0+deb13u1 | < 7:8.1.1-1
Ffmpeg1 product
- ffmpeg≤ 8.0.1
7 vendors · 30 products
References
10 links- excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65fREPORTWEBExploitMitigationThird Party Advisory
