Linux · 
openSUSE Leap · Security advisory · September 18, 2026
openSUSE Leap · Security advisory · September 18, 2026OPENSUSE-SU-2026:21877-1: ffmpeg-7 security update
OPENSUSE-SU-2026:21877-1, released September 18, 2026, fixes 26 CVEs in ffmpeg-7 (version 7.1.5-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
26
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0157
75th percentile
Priority of the 26 CVEs
Patch now 0
Urgent 1
High 2
Routine 23
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| ffmpeg-7 | opensuse-leap 16.0 | 7.1.5-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2024-35367 | ffmpeg: ffmpeg - security update | 9.1 | 0.0069 | None reported |
| High | CVE-2026-8461 | ffmpeg: An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows den... | 8.8 | 0.0157 | None reported |
| High | CVE-2026-66036 | ffmpeg: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d fil... | 8.8 | 0.0040 | None reported |
| Routine | CVE-2026-64834 | ffmpeg: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/... | n/a | 0.0073 | None reported |
| Routine | CVE-2026-75143 | ffmpeg: FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c) | n/a | 0.0070 | None reported |
| Routine | CVE-2023-6602 | ffmpeg: A flaw was found in FFmpeg's TTY Demuxer | 5.3 | 0.0051 | None reported |
| Routine | CVE-2026-58049 | ffmpeg: FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor bef... | n/a | 0.0050 | None reported |
| Routine | CVE-2023-6604 | ffmpeg: A flaw was found in FFmpeg | 5.3 | 0.0047 | None reported |
| Routine | CVE-2026-12706 | ffmpeg: A use-after-free vulnerability was found in FFmpeg's RASC video decoder | 6.5 | 0.0045 | None reported |
| Routine | CVE-2024-36615 | ffmpeg: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder | 5.9 | 0.0044 | None reported |
| Routine | CVE-2026-64833 | ffmpeg: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attac... | n/a | 0.0040 | None reported |
| Routine | CVE-2025-22921 | ffmpeg: FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain asegmentation violation via the component /libavcode... | 6.5 | 0.0037 | None reported |
| Routine | CVE-2026-66037 | ffmpeg: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAM... | 5.5 | 0.0035 | None reported |
| Routine | CVE-2026-65703 | ffmpeg: FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows... | n/a | 0.0033 | None reported |
| Routine | CVE-2026-75146 | ffmpeg: FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c) | n/a | 0.0026 | None reported |
| Routine | CVE-2026-70632 | ffmpeg: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the nativ... | n/a | 0.0023 | None reported |
| Routine | CVE-2026-75141 | ffmpeg: FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer | n/a | 0.0020 | None reported |
| Routine | CVE-2026-75142 | ffmpeg: FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c) | n/a | 0.0020 | None reported |
| Routine | CVE-2026-75144 | ffmpeg: FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavfor... | n/a | 0.0020 | None reported |
| Routine | CVE-2026-65705 | ffmpeg: FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that... | n/a | 0.0019 | None reported |
| Routine | CVE-2026-65706 | ffmpeg: FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that a... | n/a | 0.0019 | None reported |
| Routine | CVE-2026-65704 | ffmpeg: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by... | n/a | 0.0018 | None reported |
| Routine | CVE-2026-70631 | ffmpeg: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability... | n/a | 0.0018 | None reported |
| Routine | CVE-2026-70629 | ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the... | n/a | 0.0018 | None reported |
| Routine | CVE-2026-70630 | ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the... | n/a | 0.0018 | None reported |
Showing 1 to 25 of 26
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.