{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"ffmpeg security update", "category":"general", "title":"Synopsis" }, { "text":"An update for ffmpeg is now available for openEuler-24.03-LTS-SP1", "category":"general", "title":"Summary" }, { "text":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\n\nSecurity Fix(es):\n\nA memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)\n\nFFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)\n\nA vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)", "category":"general", "title":"Description" }, { "text":"An update for ffmpeg is now available for openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"ffmpeg", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4145", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4145" }, { "summary":"CVE-2026-30754", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-30754&packageName=ffmpeg" }, { "summary":"CVE-2026-52296", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-52296&packageName=ffmpeg" }, { "summary":"CVE-2026-90815", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-90815&packageName=ffmpeg" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815" }, { "summary":"openEuler-SA-2026-4145 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4145.json" } ], "title":"An update for ffmpeg is now available for openEuler-24.03-LTS-SP1", "tracking":{ "initial_release_date":"2026-10-08T09:38:52+08:00", "revision_history":[ { "date":"2026-10-08T09:38:52+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-10-08T09:38:52+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-10-08T09:38:52+08:00", "id":"openEuler-SA-2026-4145", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"ffmpeg-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"ffmpeg-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"libavdevice-6.1.1-52.oe2403sp1.aarch64.rpm", "name":"libavdevice-6.1.1-52.oe2403sp1.aarch64.rpm" }, "name":"libavdevice-6.1.1-52.oe2403sp1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-6.1.1-52.oe2403sp1.src.rpm", "name":"ffmpeg-6.1.1-52.oe2403sp1.src.rpm" }, "name":"ffmpeg-6.1.1-52.oe2403sp1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"ffmpeg-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"ffmpeg-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"libavdevice-6.1.1-52.oe2403sp1.x86_64.rpm", "name":"libavdevice-6.1.1-52.oe2403sp1.x86_64.rpm" }, "name":"libavdevice-6.1.1-52.oe2403sp1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "name":"ffmpeg-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"libavdevice-6.1.1-52.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "name":"libavdevice-6.1.1-52.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-6.1.1-52.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "name":"ffmpeg-6.1.1-52.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "name":"ffmpeg-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "name":"ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "name":"ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "name":"ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "name":"ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"libavdevice-6.1.1-52.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64", "name":"libavdevice-6.1.1-52.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-30754", "notes":[ { "text":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4145" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-30754" }, { "cve":"CVE-2026-52296", "notes":[ { "text":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4145" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"LOW", "baseScore":2.9, "vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"Low", "category":"impact" } ], "title":"CVE-2026-52296" }, { "cve":"CVE-2026-90815", "notes":[ { "text":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ], "details":"ffmpeg security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4145" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.src", "openEuler-24.03-LTS-SP1:ffmpeg-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debuginfo-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-debugsource-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-devel-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:ffmpeg-libs-6.1.1-52.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:libavdevice-6.1.1-52.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-90815" } ] }