Linux · SUSE Linux Enterprise · Security advisory · September 14, 2026

SUSE-SU-2026:4149-1: ffmpeg-4 security update

SUSE-SU-2026:4149-1, released September 14, 2026, fixes 17 CVEs in ffmpeg-4 (version 4.4.8-150600.13.55.1). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0073
54th percentile

Priority of the 17 CVEs

Patch now 0 Urgent 0 High 1 Routine 16

Fixed package versions

ProductReleaseFixed in
ffmpeg-4sles 15.74.4.8-150600.13.55.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-66036 ffmpeg: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d fil...8.8 0.0040 None reported
Routine CVE-2026-64834 ffmpeg: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/...n/a 0.0073 None reported
Routine CVE-2026-75143 ffmpeg: FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c)n/a 0.0070 None reported
Routine CVE-2026-58049 ffmpeg: FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor bef...n/a 0.0050 None reported
Routine CVE-2026-64833 ffmpeg: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attac...n/a 0.0040 None reported
Routine CVE-2026-65703 ffmpeg: FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows...n/a 0.0033 None reported
Routine CVE-2026-75146 ffmpeg: FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c)n/a 0.0026 None reported
Routine CVE-2026-70632 ffmpeg: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the nativ...n/a 0.0023 None reported
Routine CVE-2026-75142 ffmpeg: FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c)n/a 0.0020 None reported
Routine CVE-2026-75144 ffmpeg: FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavfor...n/a 0.0020 None reported
Routine CVE-2026-65705 ffmpeg: FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that...n/a 0.0019 None reported
Routine CVE-2026-65706 ffmpeg: FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that a...n/a 0.0019 None reported
Routine CVE-2026-65704 ffmpeg: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by...n/a 0.0018 None reported
Routine CVE-2026-70631 ffmpeg: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability...n/a 0.0018 None reported
Routine CVE-2026-70629 ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the...n/a 0.0018 None reported
Routine CVE-2026-70630 ffmpeg: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the...n/a 0.0018 None reported
Routine CVE-2026-70628 ffmpeg: FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB sub...n/a 0.0015 None reported
Showing 1 to 17 of 17 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.