{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0398",
  "published": "2026-09-13T05:39:56Z",
  "modified": "2026-09-13T04:31:33Z",
  "summary": "Updated ffmpeg package fixes security vulnerabilities",
  "details": "Out-of-Bounds Write in RASC Decoder decode_dlta(). (CVE-2026-58049)\nHeap Buffer Overflow via VobSub Subtitle Demuxer. (CVE-2026-64830)\nDouble-Free in NVDEC Hardware Decoder via nvdec.c. (CVE-2026-64832)\nOut-of-Bounds Read via S/PDIF Muxer spdifenc.c. (CVE-2026-64833)\nInfinite Loop DoS via RTP/ASF Demuxer. (CVE-2026-64834)\nOut-of-Bounds Memory Access in ADX Audio Decoder. (CVE-2026-64835)\nOut-of-Bounds Write in TDSC Video Decoder. (CVE-2026-65703)\nOut-of-Bounds Write via TY Demuxer and Shorten Decoder. (CVE-2026-65704)\nvf_floodfill Out-of-Bounds Write via filter_frame(). (CVE-2026-65705)\nvf_swaprect Out-of-Bounds Write via NV12 Frame Processing.\n(CVE-2026-65706)\nHeap Out-of-Bounds Write in vf_hqdn3d Filter. (CVE-2026-66036)\nIAMF Demuxer Uncontrolled Resource Consumption via\nmix_presentation_obu(). (CVE-2026-66037)\nLCL/ZLIB Video Decoder Information Disclosure via lcldec.c.\n(CVE-2026-66038)\nMACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File.\n(CVE-2026-66039)\nHeap Out-of-Bounds Write via vf_quirc Filter. (CVE-2026-66041)\nDVB Subtitle Parser Heap Buffer Overflow via WTV File. (CVE-2026-70628)\nUninitialized Heap Memory Read in RSCC Decoder. (CVE-2026-70629)\nUninitialized Heap Memory Read in Screenpresso Decoder. (CVE-2026-70630)\nUninitialized Heap Memory Read in TIFF Decoder. (CVE-2026-70631)\nHeap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing.\n(CVE-2026-70632)\nHeap Buffer Overflow in hvcC Box Writer via HEVC Muxing.\n(CVE-2026-75141)\nStack Buffer Overflow in MPEG-PS Muxer via mpegenc.c. (CVE-2026-75142)\nHeap Buffer Overflow via RIST Protocol Reader. (CVE-2026-75143)\nHeap Buffer Overflow in VC-2/Dirac RTP Packetizer. (CVE-2026-75144)\nOut-of-Bounds Read in DASH Demuxer via dashdec.c. (CVE-2026-75146)\n",
  "upstream": [
    "CVE-2026-58049",
    "CVE-2026-64830",
    "CVE-2026-64832",
    "CVE-2026-64833",
    "CVE-2026-64834",
    "CVE-2026-64835",
    "CVE-2026-65703",
    "CVE-2026-65704",
    "CVE-2026-65705",
    "CVE-2026-65706",
    "CVE-2026-66036",
    "CVE-2026-66037",
    "CVE-2026-66038",
    "CVE-2026-66039",
    "CVE-2026-66041",
    "CVE-2026-70628",
    "CVE-2026-70629",
    "CVE-2026-70630",
    "CVE-2026-70631",
    "CVE-2026-70632",
    "CVE-2026-75141",
    "CVE-2026-75142",
    "CVE-2026-75143",
    "CVE-2026-75144",
    "CVE-2026-75146"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0398.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36272"
    },
    {
      "type": "WEB",
      "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/36MFOOZUWA23VQEN5YTRKBQNH32RPWZB/"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "ffmpeg",
        "purl": "pkg:rpm/mageia/ffmpeg?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1.1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "ffmpeg",
        "purl": "pkg:rpm/mageia/ffmpeg?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1.1.mga10.tainted"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "tainted"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}