CVE-2026-30999: ffmpeg Heap-based Buffer Overflow
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-30999DEBIAN-CVE-2026-30999CGA-2pwc-5fwh-488pCGA-35wq-w55c-qv84CGA-8g5m-3f74-2vj5CGA-8jfg-992c-6xp6CGA-fph3-xh98-rh54CGA-jqxw-6q29-hmx7CGA-2732-m6wx-475mCGA-33mg-8gpw-9vphCGA-3x5w-jfh6-cc82CGA-4w5c-5vjh-9fmxCGA-4wrj-hq39-q533CGA-63r7-p3j5-5qfpCGA-6p8g-rrf2-m2gfCGA-8738-5wgw-7x47CGA-c2gh-3p6c-9c9mCGA-ccq3-2cq3-827qCGA-cm89-q6rf-3px2CGA-fjj9-7w54-589cCGA-mh24-6v5c-72fhCGA-mv3g-7j7h-m4vmCGA-p2x3-fjhh-r46hCGA-qg33-j98f-cfm6CGA-qj5p-8f29-mx6xCGA-r65h-g9qq-gq8cCGA-rmw8-79jw-2jx9CGA-vh9g-hh48-xgvqCGA-w85q-xr84-r2j8CGA-xhrh-wx29-8g98
Published 13-04-2026Last modified 13-04-2026
Vulnerability summary
CVE-2026-30999 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in ffmpeg. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.73%
0%100%
Low · +0.28 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 13-04-2026PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.28 pp
From 0.45% on 19-09-2026
19-09-202619-10-2026
EPSS score0.73%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (excellent-oatmeal-319.notion.site)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard14 products
- eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Wolfi3 products
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1All versions (No fix recorded)
- ffmpeg-8.0< 8.0.2-r0
Ubuntu2 products
- ffmpegAll versions (No fix recorded) | < 7:4.2.7-0ubuntu0.1+esm17 | < 7:4.4.2-0ubuntu0.22.04.1+esm16
- libavAll versions (No fix recorded)
Debian1 product
- ffmpegAll versions (No fix recorded) | < 7:8.1.2-1
Ffmpeg1 product
- ffmpeg≤ 8.0.1
5 vendors · 21 products
References
10 links- excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6REPORTWEBExploitThird Party Advisory
