Bug 2564470 (CVE-2026-120210)

Summary: CVE-2026-120210 ffmpeg: ffmpeg: Information disclosure via path traversal in IMF demuxer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FFmpeg. An improper path validation issue in the Interoperable Master Format (IMF) demuxer leads to information disclosure via path traversal. By convincing a user or automated processing service to open a crafted IMF package containing directory traversal sequences or absolute paths, an attacker can access files outside the intended directory. This issue allows the attacker to probe the existence and size of local files, access unauthorized media files, or trigger unintended server-side network requests.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565053, 2565056, 2565059, 2565061, 2565063, 2565066, 2565068, 2565069, 2565072, 2565074, 2565075, 2565076    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-31 17:31:36 UTC 
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.