# SUSE-SU-2026:4149-1: ffmpeg-4 security update

SUSE-SU-2026:4149-1, released September 14, 2026, fixes 17 CVEs in ffmpeg-4 (version 4.4.8-150600.13.55.1). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4149-1
- Platform: Linux
- Released: Sep 14, 2026
- Priority: High (Closes CVE-2026-66036, high severity)
- CVEs: 17, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4149-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [ffmpeg-4](https://patchblox.com/security/data/product/linux/ffmpeg-4.md) | sles 15.7 | 4.4.8-150600.13.55.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-66036](https://patchblox.com/security/data/cve/CVE-2026-66036.md) | High | ffmpeg: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d fil... | 8.8 | 0.0040 |  |
| [CVE-2026-64834](https://patchblox.com/security/data/cve/CVE-2026-64834.md) | Routine | ffmpeg: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/... | n/a | 0.0073 |  |
| [CVE-2026-75143](https://patchblox.com/security/data/cve/CVE-2026-75143.md) | Routine | ffmpeg: FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c) | n/a | 0.0070 |  |
| [CVE-2026-58049](https://patchblox.com/security/data/cve/CVE-2026-58049.md) | Routine | ffmpeg: FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor bef... | n/a | 0.0050 |  |
| [CVE-2026-64833](https://patchblox.com/security/data/cve/CVE-2026-64833.md) | Routine | ffmpeg: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attac... | n/a | 0.0040 |  |
| [CVE-2026-65703](https://patchblox.com/security/data/cve/CVE-2026-65703.md) | Routine | ffmpeg: FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows... | n/a | 0.0033 |  |
| [CVE-2026-75146](https://patchblox.com/security/data/cve/CVE-2026-75146.md) | Routine | ffmpeg: FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c) | n/a | 0.0026 |  |
| [CVE-2026-70632](https://patchblox.com/security/data/cve/CVE-2026-70632.md) | Routine | ffmpeg: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the nativ... | n/a | 0.0023 |  |
| [CVE-2026-75142](https://patchblox.com/security/data/cve/CVE-2026-75142.md) | Routine | ffmpeg: FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c) | n/a | 0.0020 |  |
| [CVE-2026-75144](https://patchblox.com/security/data/cve/CVE-2026-75144.md) | Routine | ffmpeg: FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavfor... | n/a | 0.0020 |  |
| [CVE-2026-65705](https://patchblox.com/security/data/cve/CVE-2026-65705.md) | Routine | ffmpeg: FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that... | n/a | 0.0019 |  |
| [CVE-2026-65706](https://patchblox.com/security/data/cve/CVE-2026-65706.md) | Routine | ffmpeg: FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that a... | n/a | 0.0019 |  |
| [CVE-2026-65704](https://patchblox.com/security/data/cve/CVE-2026-65704.md) | Routine | ffmpeg: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by... | n/a | 0.0018 |  |
| [CVE-2026-70631](https://patchblox.com/security/data/cve/CVE-2026-70631.md) | Routine | ffmpeg: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability... | n/a | 0.0018 |  |
| [CVE-2026-70629](https://patchblox.com/security/data/cve/CVE-2026-70629.md) | Routine | ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the... | n/a | 0.0018 |  |
| [CVE-2026-70630](https://patchblox.com/security/data/cve/CVE-2026-70630.md) | Routine | ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the... | n/a | 0.0018 |  |
| [CVE-2026-70628](https://patchblox.com/security/data/cve/CVE-2026-70628.md) | Routine | ffmpeg: FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB sub... | n/a | 0.0015 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.