Low severity2.9NVD Advisory· Published Sep 1, 2026· Updated Oct 14, 2026

CVE-2026-52295

Description

FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy2 versions
<9.0+ 1 more
- (no CPE)range: <9.0
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*range: <9.0

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988nvdIssue TrackingPatch
git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1nvdPatch
github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPaddingnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.189
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000