Bug 2569616 (CVE-2026-125172)
| Summary: | CVE-2026-125172 ffmpeg: ffmpeg: Denial of Service via out-of-bounds read in libxevd | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbrownin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FFmpeg. An out-of-bounds read vulnerability exists in the libxevd decoder due to improper validation of Network Abstraction Layer (NAL) unit length prefixes against remaining packet data. By tricking a user or system into processing specially crafted Essential Video Coding (EVC) media, an attacker could cause the application to read beyond the packet buffer. This flaw primarily leads to an application crash, causing a Denial of Service (DoS), and may also allow disclosure of adjacent heap memory.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-10 13:14:39 UTC
|