CVE-2026-40962: ffmpeg Integer Overflow or Wraparound
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-40962DEBIAN-CVE-2026-40962CGA-3r8h-9v65-66m4CGA-4vfp-2x2w-hxchCGA-g677-ch64-fchjCGA-h7wr-gcjq-97hmCGA-j996-gc6r-5wwpCGA-q5g6-6975-j3g7CGA-rqxq-7gq4-f99jCGA-wmq6-fxqw-p9w3openSUSE-SU-2026:10767-1openSUSE-SU-2026:10768-1CGA-26jv-7pqf-rm3qCGA-36p3-g7mp-rrc5CGA-44q9-wr4m-cj5qCGA-4p93-6qf7-xfwqCGA-548h-rx2f-76c7CGA-5c7g-5v45-r5pmCGA-6396-938h-4p8hCGA-8wwc-74jq-vg2hCGA-ccq5-8fx8-xvjqCGA-f2pv-c3j9-h4xhCGA-g648-2qw5-96jfCGA-gj9p-v9q2-jrpjCGA-h3xr-2q72-xv2xCGA-hq3j-hj24-hj42CGA-j6xw-7f92-jhf5CGA-mjwx-h9jq-856rCGA-q3gq-vcqh-j3q6CGA-qmf5-gqh4-cq57CGA-r9pc-vghf-99xfCGA-vw5h-wp52-xf22CGA-ww3h-c5xq-c478CGA-x9fw-9r82-477v
Published 16-04-2026Last modified 16-04-2026
Vulnerability summary
CVE-2026-40962 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in ffmpeg. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.4% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.16%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 16-04-2026PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources6 sources · 4.9–9.8
- CVE.orgCNA4.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
+0.02 pp
From 0.13% on 18-09-2026
18-09-202618-10-2026
EPSS score0.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- eco-python-ffmpeg-6-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-devAll versions (No fix recorded)
- eco-python-ffmpeg-6-minimal-staticAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimalAll versions (No fix recorded)
- eco-python-ffmpeg-7-minimal-devAll versions (No fix recorded)
Wolfi5 products
- ffmpeg-7All versions (No fix recorded)
- ffmpeg-7.1< 7.1.3-r6
- ffmpeg-7.1-libavdevice61< 7.1.5-r2
- ffmpeg-7.1-libswscale8< 7.1.5-r2
- ffmpeg-8.0< 8.0.1-r7
Opensuse2 products
- ffmpeg-4&distro=openSUSE Tumbleweed< 4.4.6-12.1
- ffmpeg-7&distro=openSUSE Tumbleweed< 7.1.3-3.1
Ubuntu2 products
- ffmpeg< 7:4.2.7-0ubuntu0.1+esm13 | < 7:4.4.2-0ubuntu0.22.04.1+esm12 | < 7:6.1.1-3ubuntu5+esm10 | All versions (No fix recorded) | < 7:8.0.1-3ubuntu2+esm1
- libavAll versions (No fix recorded)
Debian1 product
- ffmpeg< 7:5.1.9-0+deb12u1 | < 7:7.1.4-0+deb13u1 | < 7:8.1-1
Ffmpeg1 product
- ffmpeg≥ 4.1, < 8.1 | < 8.1
6 vendors · 27 products
