JLSEC-2026-652 Critical 9.8

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...

JLSEC Published: Jun 26, 2026
Modified: Jul 23, 2026
Severity: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Packages: FFMPEG_jll < 8.1.0+0
FFMPEG_nogpl_jll < 8.1.0+0
FFplay_jll < 8.1.2+0
Upstream: CVE-2026-40962 GHSA-48wr-p98v-9w5h EUVD-2026-23153

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.