{"grype_matches":[{"artifact":{"id":"60b4bba07af9d4a3","cpes":["cpe:2.3:a:ldb:ldb:4.23.8-r0:*:*:*:*:*:*:*"],"name":"ldb","purl":"pkg:apk/alpine/ldb@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libldb.so.2"},{"path":"/usr/lib/libldb.so.2.11.0"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libldb-key-value-private-samba.so"},{"path":"/usr/lib/samba/libldb-mdb-int-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-err-map-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-int-private-samba.so"},{"path":"/usr/lib/samba/ldb"},{"path":"/usr/lib/samba/ldb/asq.so"},{"path":"/usr/lib/samba/ldb/ldb.so"},{"path":"/usr/lib/samba/ldb/mdb.so"},{"path":"/usr/lib/samba/ldb/paged_searches.so"},{"path":"/usr/lib/samba/ldb/rdn_name.so"},{"path":"/usr/lib/samba/ldb/sample.so"},{"path":"/usr/lib/samba/ldb/server_sort.so"},{"path":"/usr/lib/samba/ldb/skel.so"},{"path":"/usr/lib/samba/ldb/tdb.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"e7fc857bec58ca2f","cpes":["cpe:2.3:a:libauth-samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth-samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libauth-samba","purl":"pkg:apk/alpine/libauth-samba@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libauth-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"f821b370fe0549c8","cpes":["cpe:2.3:a:libsmbclient:libsmbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libsmbclient","purl":"pkg:apk/alpine/libsmbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsmbclient.so.0"},{"path":"/usr/lib/libsmbclient.so.0.8.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"48b3721c92eb0a22","cpes":["cpe:2.3:a:libwbclient:libwbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libwbclient","purl":"pkg:apk/alpine/libwbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libwbclient.so.0"},{"path":"/usr/lib/libwbclient.so.0.16"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac10ab65fc7d9ce4","cpes":["cpe:2.3:a:samba-client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client","purl":"pkg:apk/alpine/samba-client@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/cifsdd"},{"path":"/usr/bin/dbwrap_tool"},{"path":"/usr/bin/dumpmscat"},{"path":"/usr/bin/mdsearch"},{"path":"/usr/bin/mvxattr"},{"path":"/usr/bin/nmblookup"},{"path":"/usr/bin/oLschema2ldif"},{"path":"/usr/bin/regdiff"},{"path":"/usr/bin/regpatch"},{"path":"/usr/bin/regshell"},{"path":"/usr/bin/regtree"},{"path":"/usr/bin/rpcclient"},{"path":"/usr/bin/samba-regedit"},{"path":"/usr/bin/sharesec"},{"path":"/usr/bin/smbcacls"},{"path":"/usr/bin/smbclient"},{"path":"/usr/bin/smbcquotas"},{"path":"/usr/bin/smbget"},{"path":"/usr/bin/smbprint"},{"path":"/usr/bin/smbspool"},{"path":"/usr/bin/smbtar"},{"path":"/usr/bin/smbtree"},{"path":"/usr/bin/wspsearch"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/smbspool_krb5_wrapper"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"0653ff05925e1977","cpes":["cpe:2.3:a:samba-client-libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client-libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client-libs","purl":"pkg:apk/alpine/samba-client-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc.so.0"},{"path":"/usr/lib/libdcerpc.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libad-claims-private-samba.so"},{"path":"/usr/lib/samba/libauthn-policy-util-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-contexts-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-garbage-collect-tombstones-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-module-private-samba.so"},{"path":"/usr/lib/samba/libgpo-private-samba.so"},{"path":"/usr/lib/samba/libhttp-private-samba.so"},{"path":"/usr/lib/samba/libmscat-private-samba.so"},{"path":"/usr/lib/samba/libnetif-private-samba.so"},{"path":"/usr/lib/samba/libprinter-driver-private-samba.so"},{"path":"/usr/lib/samba/libregistry-private-samba.so"},{"path":"/usr/lib/samba/libsmbclient-raw-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"3126191b0742dcfd","cpes":["cpe:2.3:a:samba-common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_common:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-common","purl":"pkg:apk/alpine/samba-common@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/samba"},{"path":"/etc/samba"},{"path":"/etc/samba/smb.conf"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/samba"},{"path":"/var/lib"},{"path":"/var/lib/samba"},{"path":"/var/lib/samba/bind-dns"},{"path":"/var/lib/samba/private"},{"path":"/var/lib/samba/sysvol"},{"path":"/var/log"},{"path":"/var/log/samba"},{"path":"/var/run"},{"path":"/var/run/samba"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ad68879ae8acc288","cpes":["cpe:2.3:a:samba-libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-libs","purl":"pkg:apk/alpine/samba-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc-binding.so.0"},{"path":"/usr/lib/libdcerpc-binding.so.0.0.1"},{"path":"/usr/lib/libndr-krb5pac.so.0"},{"path":"/usr/lib/libndr-krb5pac.so.0.0.1"},{"path":"/usr/lib/libndr-nbt.so.0"},{"path":"/usr/lib/libndr-nbt.so.0.0.1"},{"path":"/usr/lib/libndr-standard.so.0"},{"path":"/usr/lib/libndr-standard.so.0.0.1"},{"path":"/usr/lib/libndr.so.6"},{"path":"/usr/lib/libndr.so.6.0.0"},{"path":"/usr/lib/libsamba-credentials.so.1"},{"path":"/usr/lib/libsamba-credentials.so.1.0.0"},{"path":"/usr/lib/libsamba-errors.so.1"},{"path":"/usr/lib/libsamba-errors.so.1.0.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0.0.1"},{"path":"/usr/lib/libsamba-passdb.so.0"},{"path":"/usr/lib/libsamba-passdb.so.0.30.0"},{"path":"/usr/lib/libsamdb.so.0"},{"path":"/usr/lib/libsamdb.so.0.0.1"},{"path":"/usr/lib/libsmbconf.so.0"},{"path":"/usr/lib/libsmbconf.so.0.0.1"},{"path":"/usr/lib/libsmbldap.so.2"},{"path":"/usr/lib/libsmbldap.so.2.1.0"},{"path":"/usr/lib/libtevent-util.so.0"},{"path":"/usr/lib/libtevent-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libCHARSET3-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-SEND-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-private-samba.so"},{"path":"/usr/lib/samba/libaddns-private-samba.so"},{"path":"/usr/lib/samba/libads-private-samba.so"},{"path":"/usr/lib/samba/libasn1-private-samba.so"},{"path":"/usr/lib/samba/libasn1util-private-samba.so"},{"path":"/usr/lib/samba/libauthkrb5-private-samba.so"},{"path":"/usr/lib/samba/libcli-cldap-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-nbt-private-samba.so"},{"path":"/usr/lib/samba/libcli-smb-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-spoolss-private-samba.so"},{"path":"/usr/lib/samba/libcliauth-private-samba.so"},{"path":"/usr/lib/samba/libclidns-private-samba.so"},{"path":"/usr/lib/samba/libcluster-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-private-samba.so"},{"path":"/usr/lib/samba/libcmocka-private-samba.so"},{"path":"/usr/lib/samba/libcommon-auth-private-samba.so"},{"path":"/usr/lib/samba/libdbwrap-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-pkt-auth-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-samba-private-samba.so"},{"path":"/usr/lib/samba/libevents-private-samba.so"},{"path":"/usr/lib/samba/libflag-mapping-private-samba.so"},{"path":"/usr/lib/samba/libgensec-private-samba.so"},{"path":"/usr/lib/samba/libgse-private-samba.so"},{"path":"/usr/lib/samba/libgssapi-private-samba.so"},{"path":"/usr/lib/samba/libhcrypto-private-samba.so"},{"path":"/usr/lib/samba/libheimbase-private-samba.so"},{"path":"/usr/lib/samba/libheimntlm-private-samba.so"},{"path":"/usr/lib/samba/libhx509-private-samba.so"},{"path":"/usr/lib/samba/libinterfaces-private-samba.so"},{"path":"/usr/lib/samba/libkrb5-private-samba.so"},{"path":"/usr/lib/samba/libkrb5samba-private-samba.so"},{"path":"/usr/lib/samba/libldbsamba-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-lsa3-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-netlogon3-private-samba.so"},{"path":"/usr/lib/samba/liblibsmb-private-samba.so"},{"path":"/usr/lib/samba/libmessages-dgm-private-samba.so"},{"path":"/usr/lib/samba/libmessages-util-private-samba.so"},{"path":"/usr/lib/samba/libmsghdr-private-samba.so"},{"path":"/usr/lib/samba/libmsrpc3-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba4-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-crypto-gnutls-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-private-samba.so"},{"path":"/usr/lib/samba/libnpa-tstream-private-samba.so"},{"path":"/usr/lib/samba/libquic-private-samba.so"},{"path":"/usr/lib/samba/libroken-private-samba.so"},{"path":"/usr/lib/samba/libsamba-cluster-support-private-samba.so"},{"path":"/usr/lib/samba/libsamba-modules-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-trusts-private-samba.so"},{"path":"/usr/lib/samba/libsamba-sockets-private-samba.so"},{"path":"/usr/lib/samba/libsamba3-util-private-samba.so"},{"path":"/usr/lib/samba/libsamdb-common-private-samba.so"},{"path":"/usr/lib/samba/libsecrets3-private-samba.so"},{"path":"/usr/lib/samba/libserver-id-db-private-samba.so"},{"path":"/usr/lib/samba/libserver-role-private-samba.so"},{"path":"/usr/lib/samba/libsmbd-shim-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-printf-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-private-samba.so"},{"path":"/usr/lib/samba/libtdb-wrap-private-samba.so"},{"path":"/usr/lib/samba/libutil-crypt-private-samba.so"},{"path":"/usr/lib/samba/libutil-reg-private-samba.so"},{"path":"/usr/lib/samba/libutil-setid-private-samba.so"},{"path":"/usr/lib/samba/libutil-tdb-private-samba.so"},{"path":"/usr/lib/samba/libwind-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ff247fd7e527c8e3","cpes":["cpe:2.3:a:samba-util-libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util-libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-util-libs","purl":"pkg:apk/alpine/samba-util-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsamba-util.so.0"},{"path":"/usr/lib/libsamba-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libcom-err-private-samba.so"},{"path":"/usr/lib/samba/libgenrand-private-samba.so"},{"path":"/usr/lib/samba/libiov-buf-private-samba.so"},{"path":"/usr/lib/samba/libreplace-private-samba.so"},{"path":"/usr/lib/samba/libsamba-debug-private-samba.so"},{"path":"/usr/lib/samba/libsocket-blocking-private-samba.so"},{"path":"/usr/lib/samba/libstable-sort-private-samba.so"},{"path":"/usr/lib/samba/libsys-rw-private-samba.so"},{"path":"/usr/lib/samba/libtime-basic-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-27","epss":0.0599,"percentile":0.93277}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"900ffb80dab9671a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfb6e45c254d28a5","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"9efc1be8d48b7c22","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"724a749bc9c21682","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"15c76271dd11c1ad","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"e8ded9e7fa200878","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"f11d1394df402c8a","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"183c8c11df27dbac","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"52eaa678b493070f","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"b10ac7d0b2cb5015","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"d11dfd14f69c6e11","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-27","epss":0.03738,"percentile":0.89787}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"900ffb80dab9671a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfb6e45c254d28a5","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"9efc1be8d48b7c22","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"724a749bc9c21682","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"15c76271dd11c1ad","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e8ded9e7fa200878","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"f11d1394df402c8a","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"183c8c11df27dbac","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"52eaa678b493070f","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"b10ac7d0b2cb5015","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"d11dfd14f69c6e11","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-27","epss":0.03371,"percentile":0.88691}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"900ffb80dab9671a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfb6e45c254d28a5","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"9efc1be8d48b7c22","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"724a749bc9c21682","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"15c76271dd11c1ad","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e8ded9e7fa200878","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"f11d1394df402c8a","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"183c8c11df27dbac","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"52eaa678b493070f","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"b10ac7d0b2cb5015","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"d11dfd14f69c6e11","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.34-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.34-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.34-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.34-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.34:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.34-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-27","epss":0.02071,"percentile":0.81332}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-27","epss":0.01284,"percentile":0.69965}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-27","epss":0.01284,"percentile":0.69965}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-27","epss":0.01284,"percentile":0.69965}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-27","epss":0.01284,"percentile":0.69965}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.3&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-1236","versionConstraint":"< 3.0.0.4112 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-1236","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-1236","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-1236","date":"2026-10-27","epss":0.01365,"percentile":0.71662}],"risk":0.634725,"urls":["http://code.google.com/p/chromium/issues/detail?id=37383","http://codereview.chromium.org/858001","http://flock.com/security/","http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html","http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","http://secunia.com/advisories/43068","http://src.chromium.org/viewvc/chrome?view=rev&revision=41244","http://www.vupen.com/english/advisories/2011/0212","https://bugs.webkit.org/show_bug.cgi?id=35948","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14067"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-1236","description":"The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \\x00javascript:alert sequence."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67215","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-27","epss":0.007,"percentile":0.52962}],"risk":0.546,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.3&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-3262","versionConstraint":"<= 3.0.0.3989 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-3262","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-3262","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-3262","date":"2026-10-27","epss":0.01033,"percentile":0.6365}],"risk":0.48034499999999997,"urls":["http://flock.com/security/","http://www.securityfocus.com/archive/1/513701/100/0/threaded","http://www.securityfocus.com/bid/43225","https://exchange.xforce.ibmcloud.com/vulnerabilities/61820"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-3262","description":"Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67216","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-27","epss":0.00645,"percentile":0.50733}],"risk":0.474075,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."},"relatedVulnerabilities":[]},{"artifact":{"id":"211ccf26cb857c34","cpes":["cpe:2.3:a:symfony\\/http-foundation:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http-foundation:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http_foundation:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http_foundation:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*"],"name":"symfony/http-foundation","purl":"pkg:composer/symfony/http-foundation@v7.4.15","type":"php-composer","version":"v7.4.15","language":"php","licenses":["MIT"],"locations":[{"path":"/app/www/src/3rdparty/composer/installed.json","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/app/www/src/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.4.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r925-mgvr-h9cc","versionConstraint":">=7.0.0,<7.4.19 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"symfony/http-foundation","version":"v7.4.15"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-r925-mgvr-h9cc","fix":{"state":"fixed","versions":["7.4.19"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"7.4.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108082","cwe":"CWE-1333","type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647"}],"epss":[{"cve":"CVE-2026-108082","date":"2026-10-27","epss":0.0048,"percentile":0.41239}],"risk":0.3888,"urls":["https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc","https://nvd.nist.gov/vuln/detail/CVE-2026-108082","https://github.com/symfony/symfony/pull/66048","https://github.com/symfony/symfony/pull/66491","https://github.com/symfony/symfony/commit/343a1772ce6ac03e48b228d2d7168d19750e3f36","https://github.com/symfony/symfony/commit/9ffa802e5d7e9fb8ba95eeefd27e863e83b1baca","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-108082.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-108082.yaml","https://github.com/symfony/symfony/releases/tag/v5.4.54","https://github.com/symfony/symfony/releases/tag/v6.4.48","https://github.com/symfony/symfony/releases/tag/v7.4.21","https://github.com/symfony/symfony/releases/tag/v8.1.9","https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header","https://symfony.com/cve-2026-108082"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r925-mgvr-h9cc","description":"Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header"},"relatedVulnerabilities":[{"id":"CVE-2026-108082","cvss":[{"type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108082","cwe":"CWE-1333","type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647"}],"epss":[{"cve":"CVE-2026-108082","date":"2026-10-27","epss":0.0048,"percentile":0.41239}],"urls":["https://github.com/symfony/symfony/pull/66048","https://github.com/symfony/symfony/pull/66491","https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc","https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-108082","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6."}]},{"artifact":{"id":"3bfc5b995b5339c1","cpes":["cpe:2.3:a:pixman:pixman:0.46.4-r0:*:*:*:*:*:*:*"],"name":"pixman","purl":"pkg:apk/alpine/pixman@0.46.4-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"0.46.4-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpixman-1.so.0"},{"path":"/usr/lib/libpixman-1.so.0.46.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pixman"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pixman:pixman:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pixman:pixman:0.46.4:*:*:*:*:*:*:*"],"package":{"name":"pixman","version":"0.46.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-27","epss":0.00586,"percentile":0.4783}],"risk":0.33694999999999997,"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:cups:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-6553","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:cups:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-6553","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-6553","date":"2026-10-27","epss":0.00385,"percentile":0.32357}],"risk":0.27335,"urls":["https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html","https://security.gentoo.org/glsa/201908-08","https://usn.ubuntu.com/usn/usn-3713-1","https://www.debian.org/security/2018/dsa-4243"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6553","description":"The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-16554","versionConstraint":"= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-10-27","epss":0.00367,"percentile":0.30376}],"risk":0.2559825,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67217","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-27","epss":0.00433,"percentile":0.37387}],"risk":0.24031499999999997,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61702","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-10-27","epss":0.00424,"percentile":0.36535}],"risk":0.21836,"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-27","epss":0.00358,"percentile":0.29412}],"risk":0.179,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-27","epss":0.00358,"percentile":0.29412}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-27","epss":0.00358,"percentile":0.29412}],"risk":0.179,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-27","epss":0.00358,"percentile":0.29412}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-27","epss":0.00341,"percentile":0.27437}],"risk":0.17049999999999998,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-27","epss":0.00341,"percentile":0.27437}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-27","epss":0.00341,"percentile":0.27437}],"risk":0.17049999999999998,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-27","epss":0.00341,"percentile":0.27437}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f9b289b47fbb7348","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.08.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:artifex:ghostscript:10.08.0-r0:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:apk/alpine/ghostscript@10.08.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"10.08.0-r0","language":"","licenses":["AGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/dvipdf"},{"path":"/usr/bin/eps2eps"},{"path":"/usr/bin/gs"},{"path":"/usr/bin/gsbj"},{"path":"/usr/bin/gsc"},{"path":"/usr/bin/gsdj"},{"path":"/usr/bin/gsdj500"},{"path":"/usr/bin/gslj"},{"path":"/usr/bin/gslp"},{"path":"/usr/bin/gsnd"},{"path":"/usr/bin/ijs_client_example"},{"path":"/usr/bin/ijs_server_example"},{"path":"/usr/bin/lprsetup.sh"},{"path":"/usr/bin/pdf2dsc"},{"path":"/usr/bin/pdf2ps"},{"path":"/usr/bin/pf2afm"},{"path":"/usr/bin/pfbtopfa"},{"path":"/usr/bin/pphs"},{"path":"/usr/bin/printafm"},{"path":"/usr/bin/ps2ascii"},{"path":"/usr/bin/ps2epsi"},{"path":"/usr/bin/ps2pdf"},{"path":"/usr/bin/ps2pdf12"},{"path":"/usr/bin/ps2pdf13"},{"path":"/usr/bin/ps2pdf14"},{"path":"/usr/bin/ps2pdfwr"},{"path":"/usr/bin/ps2ps"},{"path":"/usr/bin/ps2ps2"},{"path":"/usr/bin/unix-lpr.sh"},{"path":"/usr/lib"},{"path":"/usr/lib/libgs.so.10"},{"path":"/usr/lib/libgs.so.10.08"},{"path":"/usr/lib/libijs-0.35.so"},{"path":"/usr/share"},{"path":"/usr/share/fonts"},{"path":"/usr/share/fonts/Type1"},{"path":"/usr/share/ghostscript"},{"path":"/usr/share/ghostscript/Resource"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst/DroidSansFallback.ttf"},{"path":"/usr/share/ghostscript/Resource/CIDFont"},{"path":"/usr/share/ghostscript/Resource/CIDFont/ArtifexBullet"},{"path":"/usr/share/ghostscript/Resource/CMap"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/83pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-7"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan2-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hankaku"},{"path":"/usr/share/ghostscript/Resource/CMap/Hiragana"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Katakana"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-H"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-V"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Roman"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/V"},{"path":"/usr/share/ghostscript/Resource/CMap/WP-Symbol"},{"path":"/usr/share/ghostscript/Resource/ColorSpace"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultRGB"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/TrivialCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sRGB"},{"path":"/usr/share/ghostscript/Resource/Decoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Dingbats"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Symbol"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Unicode"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Wingdings"},{"path":"/usr/share/ghostscript/Resource/Decoding/Latin1"},{"path":"/usr/share/ghostscript/Resource/Decoding/StandardEncoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/Unicode"},{"path":"/usr/share/ghostscript/Resource/Encoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/CEEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertSubsetEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/NotDefEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/Wingdings"},{"path":"/usr/share/ghostscript/Resource/Font"},{"path":"/usr/share/ghostscript/Resource/Font/C059-BdIta"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/D050000L"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-BoldOblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Oblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/P052-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/StandardSymbolsPS"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-DemiItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Light"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-LightItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Book"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-BookOblique"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-DemiOblique"},{"path":"/usr/share/ghostscript/Resource/Font/Z003-MediumItalic"},{"path":"/usr/share/ghostscript/Resource/IdiomSet"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/PPI_CUtils"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/Pscript5Idiom"},{"path":"/usr/share/ghostscript/Resource/Init"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIcidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIfontmap"},{"path":"/usr/share/ghostscript/Resource/Init/FCOfontmap-PCLPS2"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap.GS"},{"path":"/usr/share/ghostscript/Resource/Init/cidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/gs_agl.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_btokn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cet.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cff.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidcm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ciddc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidtt.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cmap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cspace.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dbt_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dscp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_epsf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fapi.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fntem.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fonts.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_frsd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_icc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_il1_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_img.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_init.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_lev2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ll3.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mex_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mgl_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mro_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdf_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdfwr.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_res.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_resmp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_setpd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_statd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_std_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_sym_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_trap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ttf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ32.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ42.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_type1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_wan_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/pdf_main.ps"},{"path":"/usr/share/ghostscript/Resource/Init/xlatmap"},{"path":"/usr/share/ghostscript/Resource/SubstCID"},{"path":"/usr/share/ghostscript/Resource/SubstCID/CNS1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/GB1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Japan1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Korea1-WMode"},{"path":"/usr/share/ghostscript/iccprofiles"},{"path":"/usr/share/ghostscript/iccprofiles/a98.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/esrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/gray_to_k.icc"},{"path":"/usr/share/ghostscript/iccprofiles/lab.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/rommrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/scrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/sgray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/srgb.icc"},{"path":"/usr/share/ghostscript/lib"},{"path":"/usr/share/ghostscript/lib/PDFA_def.ps"},{"path":"/usr/share/ghostscript/lib/PDFX_def.ps"},{"path":"/usr/share/ghostscript/lib/PM760p.upp"},{"path":"/usr/share/ghostscript/lib/PM760pl.upp"},{"path":"/usr/share/ghostscript/lib/PM820p.upp"},{"path":"/usr/share/ghostscript/lib/PM820pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc670p.upp"},{"path":"/usr/share/ghostscript/lib/Stc670pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc680p.upp"},{"path":"/usr/share/ghostscript/lib/Stc680pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc740p.upp"},{"path":"/usr/share/ghostscript/lib/Stc740pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc760p.upp"},{"path":"/usr/share/ghostscript/lib/Stc760pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc777p.upp"},{"path":"/usr/share/ghostscript/lib/Stc777pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp720p.upp"},{"path":"/usr/share/ghostscript/lib/Stp720pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp870p.upp"},{"path":"/usr/share/ghostscript/lib/Stp870pl.upp"},{"path":"/usr/share/ghostscript/lib/acctest.ps"},{"path":"/usr/share/ghostscript/lib/align.ps"},{"path":"/usr/share/ghostscript/lib/bj8.rpd"},{"path":"/usr/share/ghostscript/lib/bj8gc12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8hg12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8oh06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pa06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pp12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8ts06n.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a0.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a5.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a8.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b8.upp"},{"path":"/usr/share/ghostscript/lib/caption.ps"},{"path":"/usr/share/ghostscript/lib/cbjc600.ppd"},{"path":"/usr/share/ghostscript/lib/cbjc800.ppd"},{"path":"/usr/share/ghostscript/lib/cdj550.upp"},{"path":"/usr/share/ghostscript/lib/cdj690.upp"},{"path":"/usr/share/ghostscript/lib/cdj690ec.upp"},{"path":"/usr/share/ghostscript/lib/cid2code.ps"},{"path":"/usr/share/ghostscript/lib/dnj750c.upp"},{"path":"/usr/share/ghostscript/lib/dnj750m.upp"},{"path":"/usr/share/ghostscript/lib/docie.ps"},{"path":"/usr/share/ghostscript/lib/font2pcl.ps"},{"path":"/usr/share/ghostscript/lib/ghostpdf.ppd"},{"path":"/usr/share/ghostscript/lib/gs_ce_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_css_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_il2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_kanji.ps"},{"path":"/usr/share/ghostscript/lib/gs_ksb_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_l.xbm"},{"path":"/usr/share/ghostscript/lib/gs_l.xpm"},{"path":"/usr/share/ghostscript/lib/gs_l_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_lgo_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_lgx_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_m.xpm"},{"path":"/usr/share/ghostscript/lib/gs_m_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xpm"},{"path":"/usr/share/ghostscript/lib/gs_s_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xpm"},{"path":"/usr/share/ghostscript/lib/gs_t_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_wl1_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl5_e.ps"},{"path":"/usr/share/ghostscript/lib/gslp.ps"},{"path":"/usr/share/ghostscript/lib/gsnup.ps"},{"path":"/usr/share/ghostscript/lib/ht_ccsto.ps"},{"path":"/usr/share/ghostscript/lib/image-qa.ps"},{"path":"/usr/share/ghostscript/lib/jispaper.ps"},{"path":"/usr/share/ghostscript/lib/landscap.ps"},{"path":"/usr/share/ghostscript/lib/lines.ps"},{"path":"/usr/share/ghostscript/lib/mkcidfm.ps"},{"path":"/usr/share/ghostscript/lib/necp2x.upp"},{"path":"/usr/share/ghostscript/lib/necp2x6.upp"},{"path":"/usr/share/ghostscript/lib/pdf2dsc.ps"},{"path":"/usr/share/ghostscript/lib/pdf_info.ps"},{"path":"/usr/share/ghostscript/lib/pf2afm.ps"},{"path":"/usr/share/ghostscript/lib/pfbtopfa.ps"},{"path":"/usr/share/ghostscript/lib/ppath.ps"},{"path":"/usr/share/ghostscript/lib/pphs.ps"},{"path":"/usr/share/ghostscript/lib/prfont.ps"},{"path":"/usr/share/ghostscript/lib/printafm.ps"},{"path":"/usr/share/ghostscript/lib/ps2ai.ps"},{"path":"/usr/share/ghostscript/lib/ps2epsi.ps"},{"path":"/usr/share/ghostscript/lib/ras1.upp"},{"path":"/usr/share/ghostscript/lib/ras24.upp"},{"path":"/usr/share/ghostscript/lib/ras3.upp"},{"path":"/usr/share/ghostscript/lib/ras32.upp"},{"path":"/usr/share/ghostscript/lib/ras4.upp"},{"path":"/usr/share/ghostscript/lib/ras8m.upp"},{"path":"/usr/share/ghostscript/lib/rollconv.ps"},{"path":"/usr/share/ghostscript/lib/s400a1.upp"},{"path":"/usr/share/ghostscript/lib/s400b1.upp"},{"path":"/usr/share/ghostscript/lib/sharp.upp"},{"path":"/usr/share/ghostscript/lib/sipixa6.upp"},{"path":"/usr/share/ghostscript/lib/st640ih.upp"},{"path":"/usr/share/ghostscript/lib/st640ihg.upp"},{"path":"/usr/share/ghostscript/lib/st640p.upp"},{"path":"/usr/share/ghostscript/lib/st640pg.upp"},{"path":"/usr/share/ghostscript/lib/st640pl.upp"},{"path":"/usr/share/ghostscript/lib/st640plg.upp"},{"path":"/usr/share/ghostscript/lib/stc.upp"},{"path":"/usr/share/ghostscript/lib/stc1520h.upp"},{"path":"/usr/share/ghostscript/lib/stc2.upp"},{"path":"/usr/share/ghostscript/lib/stc200_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2s_h.upp"},{"path":"/usr/share/ghostscript/lib/stc300.upp"},{"path":"/usr/share/ghostscript/lib/stc300bl.upp"},{"path":"/usr/share/ghostscript/lib/stc300bm.upp"},{"path":"/usr/share/ghostscript/lib/stc500p.upp"},{"path":"/usr/share/ghostscript/lib/stc500ph.upp"},{"path":"/usr/share/ghostscript/lib/stc600ih.upp"},{"path":"/usr/share/ghostscript/lib/stc600p.upp"},{"path":"/usr/share/ghostscript/lib/stc600pl.upp"},{"path":"/usr/share/ghostscript/lib/stc640p.upp"},{"path":"/usr/share/ghostscript/lib/stc740ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800p.upp"},{"path":"/usr/share/ghostscript/lib/stc800pl.upp"},{"path":"/usr/share/ghostscript/lib/stc_h.upp"},{"path":"/usr/share/ghostscript/lib/stc_l.upp"},{"path":"/usr/share/ghostscript/lib/stcany.upp"},{"path":"/usr/share/ghostscript/lib/stcany_h.upp"},{"path":"/usr/share/ghostscript/lib/stcinfo.ps"},{"path":"/usr/share/ghostscript/lib/stcolor.ps"},{"path":"/usr/share/ghostscript/lib/stocht.ps"},{"path":"/usr/share/ghostscript/lib/traceimg.ps"},{"path":"/usr/share/ghostscript/lib/traceop.ps"},{"path":"/usr/share/ghostscript/lib/uninfo.ps"},{"path":"/usr/share/ghostscript/lib/viewcmyk.ps"},{"path":"/usr/share/ghostscript/lib/viewgif.ps"},{"path":"/usr/share/ghostscript/lib/viewjpeg.ps"},{"path":"/usr/share/ghostscript/lib/viewmiff.ps"},{"path":"/usr/share/ghostscript/lib/viewpbm.ps"},{"path":"/usr/share/ghostscript/lib/viewpcx.ps"},{"path":"/usr/share/ghostscript/lib/viewps2a.ps"},{"path":"/usr/share/ghostscript/lib/winmaps.ps"},{"path":"/usr/share/ghostscript/lib/zeroline.ps"},{"path":"/usr/share/ghostscript/lib/zugferd.ps"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ghostscript"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-38560","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:artifex:ghostscript:10.08.0:*:*:*:*:*:*:*"],"package":{"name":"ghostscript","version":"10.08.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-38560","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-38560","date":"2026-10-27","epss":0.00323,"percentile":0.25205}],"risk":0.169575,"urls":["https://access.redhat.com/security/cve/CVE-2023-38560","https://bugs.ghostscript.com/show_bug.cgi?id=706898","https://bugzilla.redhat.com/show_bug.cgi?id=2224368","https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-27","epss":0.00338,"percentile":0.27121}],"risk":0.169,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-27","epss":0.00338,"percentile":0.27121}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-27","epss":0.00338,"percentile":0.27121}],"risk":0.169,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-27","epss":0.00338,"percentile":0.27121}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-27","epss":0.00319,"percentile":0.24705}],"risk":0.1595,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-27","epss":0.00319,"percentile":0.24705}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-27","epss":0.00319,"percentile":0.24705}],"risk":0.1595,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-27","epss":0.00319,"percentile":0.24705}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-27","epss":0.00314,"percentile":0.24163}],"risk":0.157,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-27","epss":0.00314,"percentile":0.24163}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-27","epss":0.00314,"percentile":0.24163}],"risk":0.157,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-27","epss":0.00314,"percentile":0.24163}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-27","epss":0.002,"percentile":0.09813}],"risk":0.1565,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-27","epss":0.00313,"percentile":0.24036}],"risk":0.1565,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-27","epss":0.00313,"percentile":0.24036}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-27","epss":0.00313,"percentile":0.24036}],"risk":0.1565,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-27","epss":0.00313,"percentile":0.24036}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-27","epss":0.00293,"percentile":0.21698}],"risk":0.1465,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-27","epss":0.00293,"percentile":0.21698}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-27","epss":0.00293,"percentile":0.21698}],"risk":0.1465,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-27","epss":0.00293,"percentile":0.21698}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-27","epss":0.00266,"percentile":0.18415}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-27","epss":0.00266,"percentile":0.18415}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-27","epss":0.00266,"percentile":0.18415}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-27","epss":0.00266,"percentile":0.18415}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-27","epss":0.00257,"percentile":0.1728}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-27","epss":0.00257,"percentile":0.1728}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-27","epss":0.00257,"percentile":0.1728}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-27","epss":0.00257,"percentile":0.1728}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-27","epss":0.00252,"percentile":0.16577}],"risk":0.126,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-27","epss":0.00252,"percentile":0.16577}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-27","epss":0.00252,"percentile":0.16577}],"risk":0.126,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-27","epss":0.00252,"percentile":0.16577}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-27","epss":0.00244,"percentile":0.15474}],"risk":0.122,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-27","epss":0.00244,"percentile":0.15474}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-27","epss":0.00244,"percentile":0.15474}],"risk":0.122,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-27","epss":0.00244,"percentile":0.15474}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-27","epss":0.00239,"percentile":0.14957}],"risk":0.11950000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-27","epss":0.00239,"percentile":0.14957}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-27","epss":0.00239,"percentile":0.14957}],"risk":0.11950000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-27","epss":0.00239,"percentile":0.14957}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-27","epss":0.00237,"percentile":0.1466}],"risk":0.11850000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-27","epss":0.00237,"percentile":0.1466}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-27","epss":0.00237,"percentile":0.1466}],"risk":0.11850000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-27","epss":0.00237,"percentile":0.1466}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-27","epss":0.00145,"percentile":0.03735}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107886","versionConstraint":">= 1.4.8, < 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-27","epss":0.00241,"percentile":0.15185}],"risk":0.11327,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-27","epss":0.00221,"percentile":0.12575}],"risk":0.11050000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-27","epss":0.00221,"percentile":0.12575}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-27","epss":0.00221,"percentile":0.12575}],"risk":0.11050000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-27","epss":0.00221,"percentile":0.12575}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55480","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55480","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":5.7,"impactScore":5.2,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55480","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55480","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55480","date":"2026-10-27","epss":0.00202,"percentile":0.10113}],"risk":0.10807000000000001,"urls":["https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62","https://github.com/OpenPrinting/cups/commit/f6a11dae0f0f3b748fbca931e237be03ffe8e48e","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55480","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-27","epss":0.00216,"percentile":0.11929}],"risk":0.108,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-27","epss":0.00216,"percentile":0.11929}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-27","epss":0.00216,"percentile":0.11929}],"risk":0.108,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-27","epss":0.00216,"percentile":0.11929}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-27","epss":0.00208,"percentile":0.10817}],"risk":0.104,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-27","epss":0.00208,"percentile":0.10817}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-27","epss":0.00208,"percentile":0.10817}],"risk":0.104,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-27","epss":0.00208,"percentile":0.10817}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-27","epss":0.00186,"percentile":0.08077}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-27","epss":0.00138,"percentile":0.03179}],"risk":0.09935999999999999,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-27","epss":0.00178,"percentile":0.073}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-27","epss":0.00158,"percentile":0.04885}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-27","epss":0.00175,"percentile":0.06933}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-27","epss":0.00179,"percentile":0.07423}],"risk":0.08592,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-27","epss":0.00176,"percentile":0.07055}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-27","epss":0.00186,"percentile":0.08134}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-27","epss":0.00186,"percentile":0.08134}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-27","epss":0.00186,"percentile":0.08134}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-27","epss":0.00186,"percentile":0.08134}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-27","epss":0.00108,"percentile":0.0119}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-27","epss":0.00153,"percentile":0.04369}],"risk":0.0765,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-27","epss":0.00153,"percentile":0.04369}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-27","epss":0.00153,"percentile":0.04369}],"risk":0.0765,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-27","epss":0.00153,"percentile":0.04369}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-27","epss":0.00116,"percentile":0.01593}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107890","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107890","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-10-27","epss":0.00149,"percentile":0.04062}],"risk":0.07003000000000001,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-27","epss":0.00137,"percentile":0.03074}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107885","versionConstraint":"< 2.4.21 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107885","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-10-27","epss":0.00147,"percentile":0.03925}],"risk":0.06909,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-hhw5-qqmc-p6rg"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885","description":"OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107888","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107888","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-10-27","epss":0.00133,"percentile":0.02786}],"risk":0.068495,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-27","epss":0.00131,"percentile":0.02688}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-27","epss":0.00131,"percentile":0.02688}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-27","epss":0.00131,"percentile":0.02688}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-27","epss":0.00131,"percentile":0.02688}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-27","epss":0.00142,"percentile":0.03513}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55453","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55453","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55453","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55453","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55453","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55453","date":"2026-10-27","epss":0.00195,"percentile":0.09077}],"risk":0.06142499999999999,"urls":["https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7","https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55453","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-27","epss":0.00115,"percentile":0.01548}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-27","epss":0.00111,"percentile":0.01297}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55467","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55467","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55467","cwe":"CWE-93","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55467","cwe":"CWE-94","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55467","cwe":"CWE-150","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55467","date":"2026-10-27","epss":0.00182,"percentile":0.07738}],"risk":0.05005000000000001,"urls":["https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681","https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55467","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-27","epss":0.00093,"percentile":0.00515}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"03d40e747f1d68fb","cpes":["cpe:2.3:a:files-pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files-pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"files_pdfviewer","purl":"pkg:npm/files_pdfviewer@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/files_pdfviewer/package.json","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/app/www/src/apps/files_pdfviewer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46fq-v4pg-gr3j","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"files_pdfviewer","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46fq-v4pg-gr3j","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46fq-v4pg-gr3j","description":"Malware in files_pdfviewer"},"relatedVulnerabilities":[]},{"artifact":{"id":"91680863d5c139d4","cpes":["cpe:2.3:a:firstrunwizard:firstrunwizard:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"firstrunwizard","purl":"pkg:npm/firstrunwizard@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/firstrunwizard/package.json","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/app/www/src/apps/firstrunwizard/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqc2-7f54-r7wp","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"firstrunwizard","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqc2-7f54-r7wp","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqc2-7f54-r7wp","description":"Malware in firstrunwizard"},"relatedVulnerabilities":[]},{"artifact":{"id":"cbd77e4fe96fe423","cpes":["cpe:2.3:a:rust-random:rand:0.9.1:*:*:*:*:rust:*:*"],"name":"rand","purl":"pkg:cargo/rand@0.9.1","type":"rust-crate","version":"0.9.1","language":"rust","licenses":[],"locations":[{"path":"/usr/lib/librav1e.so.0.8.1","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/usr/lib/librav1e.so.0.8.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cq8v-f236-94qc","versionConstraint":">=0.9.0,<0.9.3 (unknown)"},"matcher":"rust-matcher","searchedBy":{"package":{"name":"rand","version":"0.9.1"},"language":"rust","namespace":"github:language:rust"}}],"vulnerability":{"id":"GHSA-cq8v-f236-94qc","fix":{"state":"fixed","versions":["0.9.3"],"available":[{"date":"2026-04-14","kind":"first-observed","version":"0.9.3"}]},"cvss":[],"risk":0,"urls":["https://github.com/rust-random/rand/pull/1763","https://rustsec.org/advisories/RUSTSEC-2026-0097.html"],"severity":"Low","namespace":"github:language:rust","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cq8v-f236-94qc","description":"Rand is unsound with a custom logger using rand::rng()"},"relatedVulnerabilities":[]},{"artifact":{"id":"61eb258d7cce9ccb","cpes":["cpe:2.3:a:web-auth\\/webauthn-lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn-lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*"],"name":"web-auth/webauthn-lib","purl":"pkg:composer/web-auth/webauthn-lib@4.9.3","type":"php-composer","version":"4.9.3","language":"php","licenses":["MIT"],"locations":[{"path":"/app/www/src/3rdparty/composer/installed.json","layerID":"sha256:cae359af97018ee02995daa93357ebef6d61667d938992514287ac259c8d9f5c","accessPath":"/app/www/src/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gq4g-fpc9-vjfq","versionConstraint":">=4.9.0,<5.3.5 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"web-auth/webauthn-lib","version":"4.9.3"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gq4g-fpc9-vjfq","fix":{"state":"fixed","versions":["5.3.5"],"available":[{"date":"2026-07-08","kind":"first-observed","version":"5.3.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gq4g-fpc9-vjfq","description":"Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-28T23:23:17.023Z","grype_db_version":"2026-10-28T06:23:30.000Z"}