This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-75141 →
UBUNTU-CVE-2026-75141
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of...
Original description
The description as published by the source.
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
libav
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1+esm17"}]}]
Ubuntu:Pro:18.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm15"}]}]
Ubuntu:Pro:20.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm16"}]}]
Ubuntu:Pro:22.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm15"}]}]
Ubuntu:Pro:24.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm13"}]}]
Ubuntu:26.10
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:26.04:LTS
ffmpeg
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.0.1-3ubuntu2+esm4"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report code.ffmpeg.org