{"schemaVersion":3,"id":"USN-8915-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"ffmpeg vulnerabilities\n\nMomoko Shiraishi discovered that FFmpeg did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2026-30754)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-38344)\n\nIt was discovered that FFmpeg did not correctly handle certain arithmetic\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-38346, CVE-2026-38348, CVE-2026-38349)\n\nIt was discovered that FFmpeg did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38347)\n\nIt was discovered that FFmpeg did not correctly handle certain arithmetic\noperations. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38350)\n\nJoshua Rogers discovered that FFmpeg did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to leak\nsensitive information. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-75147)","dates":{"published":"2026-10-12T23:14:33.000Z","modified":"2026-10-13T15:26:55.540Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"ffmpeg","name":"ffmpeg","label":"ffmpeg","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ffmpeg","purlType":"deb","versions":[{"text":"< 7:2.8.17-0ubuntu0.1+esm18","noFixRecorded":false,"fixedIn":null},{"text":"< 7:3.4.11-0ubuntu0.1+esm16","noFixRecorded":false,"fixedIn":null},{"text":"< 7:4.2.7-0ubuntu0.1+esm18","noFixRecorded":false,"fixedIn":null},{"text":"< 7:4.4.2-0ubuntu0.22.04.1+esm17","noFixRecorded":false,"fixedIn":null},{"text":"< 7:6.1.1-3ubuntu5+esm15","noFixRecorded":false,"fixedIn":null},{"text":"< 7:8.0.1-3ubuntu2+esm5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7:2.8.17-0ubuntu0.1+esm18 | < 7:3.4.11-0ubuntu0.1+esm16 | < 7:4.2.7-0ubuntu0.1+esm18 | < 7:4.4.2-0ubuntu0.22.04.1+esm17 | < 7:6.1.1-3ubuntu5+esm15 | < 7:8.0.1-3ubuntu2+esm5","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8915-1","label":"ubuntu.com/security/notices/USN-8915-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-30754","label":"ubuntu.com/security/CVE-2026-30754","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38344","label":"ubuntu.com/security/CVE-2026-38344","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38346","label":"ubuntu.com/security/CVE-2026-38346","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38347","label":"ubuntu.com/security/CVE-2026-38347","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38348","label":"ubuntu.com/security/CVE-2026-38348","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38349","label":"ubuntu.com/security/CVE-2026-38349","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-38350","label":"ubuntu.com/security/CVE-2026-38350","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-75147","label":"ubuntu.com/security/CVE-2026-75147","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-30754","CVE-2026-38344","CVE-2026-38346","CVE-2026-38347","CVE-2026-38348","CVE-2026-38349","CVE-2026-38350","CVE-2026-75147"],"downstream":[],"duplicates":[],"related":["CVE-2026-30754","CVE-2026-38344","CVE-2026-38346","CVE-2026-38347","CVE-2026-38348","CVE-2026-38349","CVE-2026-38350","CVE-2026-75147"]},"timeline":[{"kind":"published","date":"2026-10-12T23:14:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-13T15:26:55.540Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:20:24.832Z","stale":false,"partial":false}}