CVE-2026-107676

Katalog CVE

CVSS 3.3 · Low EPSS 0,12%

Kerentanan Use of Uninitialized Resource. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

14 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-908: Use of Uninitialized Resource

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590
• https://ffmpeg.org/
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-s...