Bug 2548035 (CVE-2026-107676)

Summary: CVE-2026-107676 ffmpeg: ffmpeg: Information disclosure via uninitialized memory in HDR metadata processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bbrownin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FFmpeg. This vulnerability allows an attacker to trigger an information disclosure by providing a specially crafted media file containing manipulated High Dynamic Range (HDR) metadata. When FFmpeg processes the media file during conversion or transcoding, uninitialized memory bytes can be written into the output file. Consequently, an attacker can obtain leaked process memory contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2549550, 2549551, 2549553, 2549554, 2549558, 2549564    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 15:51:25 UTC 
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.