An update for ffmpeg is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4808 Final 1.0 1.0 2026-11-11 Initial 2026-11-11 2026-11-11 openEuler SA Tool V1.0 2026-11-11 ffmpeg security update An update for ffmpeg is now available for openEuler-22.03-LTS-SP4 FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fix(es): FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678) FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243) FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244) FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245) FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246) FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247) An update for ffmpeg is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium ffmpeg https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107678 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-120243 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-120244 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-120245 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-120246 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-120247 https://nvd.nist.gov/vuln/detail/CVE-2026-107678 https://nvd.nist.gov/vuln/detail/CVE-2026-120243 https://nvd.nist.gov/vuln/detail/CVE-2026-120244 https://nvd.nist.gov/vuln/detail/CVE-2026-120245 https://nvd.nist.gov/vuln/detail/CVE-2026-120246 https://nvd.nist.gov/vuln/detail/CVE-2026-120247 openEuler-22.03-LTS-SP4 ffmpeg-4.2.4-59.oe2203sp4.x86_64.rpm ffmpeg-debuginfo-4.2.4-59.oe2203sp4.x86_64.rpm ffmpeg-debugsource-4.2.4-59.oe2203sp4.x86_64.rpm ffmpeg-devel-4.2.4-59.oe2203sp4.x86_64.rpm ffmpeg-libs-4.2.4-59.oe2203sp4.x86_64.rpm libavdevice-4.2.4-59.oe2203sp4.x86_64.rpm ffmpeg-4.2.4-58.oe2203sp4.aarch64.rpm ffmpeg-debuginfo-4.2.4-58.oe2203sp4.aarch64.rpm ffmpeg-debugsource-4.2.4-58.oe2203sp4.aarch64.rpm ffmpeg-devel-4.2.4-58.oe2203sp4.aarch64.rpm ffmpeg-libs-4.2.4-58.oe2203sp4.aarch64.rpm libavdevice-4.2.4-58.oe2203sp4.aarch64.rpm ffmpeg-4.2.4-58.oe2203sp4.src.rpm ffmpeg-4.2.4-59.oe2203sp4.src.rpm FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption. 2026-11-11 CVE-2026-107678 openEuler-22.03-LTS-SP4 Medium 4.7 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output. 2026-11-11 CVE-2026-120243 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels. 2026-11-11 CVE-2026-120244 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output. 2026-11-11 CVE-2026-120245 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output. 2026-11-11 CVE-2026-120246 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808 FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents. 2026-11-11 CVE-2026-120247 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808