Unrated
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
CVE-2026-40962
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-40962 ffmpeg
- Ubuntu UBUNTU-CVE-2026-40962 libav
References
- advisory github.com
- advisory nvd.nist.gov
- web code.ffmpeg.org