Advisories » MGASA-2026-0398

Updated ffmpeg package fixes security vulnerabilities

Publication date: 13 Sep 2026
Modification date: 13 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-58049 , CVE-2026-64830 , CVE-2026-64832 , CVE-2026-64833 , CVE-2026-64834 , CVE-2026-64835 , CVE-2026-65703 , CVE-2026-65704 , CVE-2026-65705 , CVE-2026-65706 , CVE-2026-66036 , CVE-2026-66037 , CVE-2026-66038 , CVE-2026-66039 , CVE-2026-66041 , CVE-2026-70628 , CVE-2026-70629 , CVE-2026-70630 , CVE-2026-70631 , CVE-2026-70632 , CVE-2026-75141 , CVE-2026-75142 , CVE-2026-75143 , CVE-2026-75144 , CVE-2026-75146

Description

Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)
Heap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)
Double-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)
Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)
Infinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)
Out-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)
Out-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)
Out-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)
vf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)
vf_swaprect Out-of-Bounds Write via NV12 Frame Processing.
(CVE-2026-65706)
Heap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)
IAMF Demuxer Uncontrolled Resource Consumption via
mix_presentation_obu(). (CVE-2026-66037)
LCL/ZLIB Video Decoder Information Disclosure via lcldec.c.
(CVE-2026-66038)
MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.
(CVE-2026-66039)
Heap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)
DVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)
Uninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)
Uninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)
Uninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)
Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.
(CVE-2026-70632)
Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing.
(CVE-2026-75141)
Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)
Heap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)
Heap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)
Out-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36272
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/
• https://www.cve.org/CVERecord?id=CVE-2026-58049
• https://www.cve.org/CVERecord?id=CVE-2026-64830
• https://www.cve.org/CVERecord?id=CVE-2026-64832
• https://www.cve.org/CVERecord?id=CVE-2026-64833
• https://www.cve.org/CVERecord?id=CVE-2026-64834
• https://www.cve.org/CVERecord?id=CVE-2026-64835
• https://www.cve.org/CVERecord?id=CVE-2026-65703
• https://www.cve.org/CVERecord?id=CVE-2026-65704
• https://www.cve.org/CVERecord?id=CVE-2026-65705
• https://www.cve.org/CVERecord?id=CVE-2026-65706
• https://www.cve.org/CVERecord?id=CVE-2026-66036
• https://www.cve.org/CVERecord?id=CVE-2026-66037
• https://www.cve.org/CVERecord?id=CVE-2026-66038
• https://www.cve.org/CVERecord?id=CVE-2026-66039
• https://www.cve.org/CVERecord?id=CVE-2026-66041
• https://www.cve.org/CVERecord?id=CVE-2026-70628
• https://www.cve.org/CVERecord?id=CVE-2026-70629
• https://www.cve.org/CVERecord?id=CVE-2026-70630
• https://www.cve.org/CVERecord?id=CVE-2026-70631
• https://www.cve.org/CVERecord?id=CVE-2026-70632
• https://www.cve.org/CVERecord?id=CVE-2026-75141
• https://www.cve.org/CVERecord?id=CVE-2026-75142
• https://www.cve.org/CVERecord?id=CVE-2026-75143
• https://www.cve.org/CVERecord?id=CVE-2026-75144
• https://www.cve.org/CVERecord?id=CVE-2026-75146

SRPMS

10/core

• ffmpeg-7.1.5-1.1.mga10

10/tainted

• ffmpeg-7.1.5-1.1.mga10.tainted