Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75146] FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec…

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75147] FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/r…

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counte…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75141] FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an…

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75142] FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpeg…

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75144] FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP pac…

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted inp…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73680] Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration th…

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sani…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70632] FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerabi…

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70628] FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerabili…

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-c…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP: desbordamiento de búfer en decodificador TSMF FFmpeg

FreeRDP anterior a versión 3.29.0 contiene una vulnerabilidad de lectura fuera de los límites de memoria en el decodificador TSMF FFmpeg al procesar tipos de medios AVC1 MPEG2VIDEOINFO con datos insuficientes. Un atacante puede enviar datos de formato multimedia malformados desde un servidor RDP para causar un fallo del cliente. Esta vulnerabilidad afecta directamente a entornos de escritorio remoto y soluciones de virtualización ampliamente utilizadas en empresas LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66040] FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in …

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66041] FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability…

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data excee…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66036] FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in …

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66039] FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in t…

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_fra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65705] FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill v…

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processe…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65706] FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect vi…

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65703] FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video dec…

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65704] FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause he…

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64832] FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware d…

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame descripti…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64833] FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer …

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF r…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64834] FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer wi…

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than…

nvdaltovulnerabilidad CVSS 7.5 NVD