JLSEC-2026-652 Medium 4.9

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...

JLSEC Published: Jun 26, 2026
Modified: Jun 26, 2026
Severity: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Packages: FFMPEG_jll < 8.1.0+0
FFMPEG_nogpl_jll < 8.1.0+0
FFplay_jll < 8.1.2+0
Aliases / Upstream: CVE-2026-40962 GHSA-48wr-p98v-9w5h EUVD-2026-23153

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.