← All advisories

Medium severity4.9NVD Advisory· Published Apr 16, 2026· Updated Apr 20, 2026

CVE-2026-40962

CVE-2026-40962

Description

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

15

FFmpeg/Ffmpeg2 versions
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*range: <8.1
- (no CPE)range: <8.1
osv-coords13 versions
pkg:apk/chainguard/ffmpeg-6 pkg:apk/chainguard/ffmpeg-7.1 pkg:apk/chainguard/ffmpeg-8.0 pkg:apk/wolfi/ffmpeg-7.1 pkg:apk/wolfi/ffmpeg-8.0 pkg:rpm/opensuse/ffmpeg-4&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ffmpeg-7&distro=openSUSE%20Tumbleweed pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7
< 6.1.4-r4+ 12 more
- (no CPE)range: < 6.1.4-r4
- (no CPE)range: < 7.1.3-r6
- (no CPE)range: < 8.0.1-r7
- (no CPE)range: < 7.1.3-r6
- (no CPE)range: < 8.0.1-r7
- (no CPE)range: < 4.4.6-12.1
- (no CPE)range: < 7.1.3-3.1
- (no CPE)range: < 4.4.7-150400.3.67.1
- (no CPE)range: < 4.4.7-150400.3.67.1
- (no CPE)range: < 4.4.7-150600.13.47.1
- (no CPE)range: < 4.4.7-150400.3.67.1
- (no CPE)range: < 4.4.7-150400.3.67.1
- (no CPE)range: < 4.4.7-150600.13.47.1

Patches

Vulnerability mechanics

References

1

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348nvdIssue TrackingPatch

News mentions

0

No linked articles in our index yet.