{"grype_matches":[{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-19","epss":0.04697,"percentile":0.91699}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-47917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-47917","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-10-19","epss":0.02275,"percentile":0.82832}],"risk":1.1375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-47917"},"relatedVulnerabilities":[{"id":"CVE-2025-47917","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H","metrics":{"baseScore":8.9,"impactScore":6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47917","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47917","date":"2026-10-19","epss":0.02275,"percentile":0.82832}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47917","description":"Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN)."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-19","epss":0.01533,"percentile":0.74424}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-19","epss":0.01436,"percentile":0.72742}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-19","epss":0.01179,"percentile":0.67206}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-19","epss":0.01829,"percentile":0.78535}],"risk":0.5487,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-19","epss":0.01829,"percentile":0.78535}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"0d5f0d693a903e53","cpes":["cpe:2.3:a:libturbojpeg:libturbojpeg:1\\:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libturbojpeg","purl":"pkg:deb/ubuntu/libturbojpeg@1%3A2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo%402.1.5-2ubuntu2","type":"deb","version":"1:2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libturbojpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libturbojpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libturbojpeg:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libturbojpeg:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-19","epss":0.01829,"percentile":0.78535}],"risk":0.5487,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-19","epss":0.01829,"percentile":0.78535}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-19","epss":0.01824,"percentile":0.7848}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-19","epss":0.01824,"percentile":0.7848}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-19","epss":0.01824,"percentile":0.7848}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-19","epss":0.01824,"percentile":0.7848}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-19","epss":0.01724,"percentile":0.77175}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6988"},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-19","epss":0.01724,"percentile":0.77175}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"risk":0.5165000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-19","epss":0.01033,"percentile":0.63209}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-24119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2021-24119","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-24119","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24119","date":"2026-10-19","epss":0.01484,"percentile":0.73595}],"risk":0.44520000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-24119"},"relatedVulnerabilities":[{"id":"CVE-2021-24119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-24119","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24119","date":"2026-10-19","epss":0.01484,"percentile":0.73595}],"urls":["https://github.com/ARMmbed/mbedtls/releases","https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md","https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html","https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/","https://lists.debian.org/debian-lts-announce/2025/06/msg00034.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-24119","description":"In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-19","epss":0.0148,"percentile":0.7353}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-19","epss":0.0148,"percentile":0.7353}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-19","epss":0.0148,"percentile":0.7353}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-19","epss":0.0148,"percentile":0.7353}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-19","epss":0.00829,"percentile":0.56792}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-19","epss":0.00829,"percentile":0.56792}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-19","epss":0.00829,"percentile":0.56792}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-19","epss":0.00829,"percentile":0.56792}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-57052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-57052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-10-19","epss":0.00743,"percentile":0.53888}],"risk":0.3715,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-57052"},"relatedVulnerabilities":[{"id":"CVE-2025-57052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-57052","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-57052","cwe":"CWE-129","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-57052","date":"2026-10-19","epss":0.00743,"percentile":0.53888}],"urls":["https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability","https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"risk":0.364,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-19","epss":0.00728,"percentile":0.53341}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34877","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-10-19","epss":0.00725,"percentile":0.53241}],"risk":0.36250000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34877"},"relatedVulnerabilities":[{"id":"CVE-2026-34877","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34877","cwe":"CWE-250","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-34877","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34877","date":"2026-10-19","epss":0.00725,"percentile":0.53241}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34877","description":"An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-19","epss":0.0071,"percentile":0.52673}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-19","epss":0.00702,"percentile":0.52399}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67215","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-19","epss":0.007,"percentile":0.52292}],"risk":0.35000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67215"},"relatedVulnerabilities":[{"id":"CVE-2026-67215","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-19","epss":0.007,"percentile":0.52292}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-19","epss":0.00683,"percentile":0.51655}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-19","epss":0.00681,"percentile":0.51552}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-19","epss":0.00674,"percentile":0.51246}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-19","epss":0.00674,"percentile":0.51246}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-19","epss":0.00674,"percentile":0.51246}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-19","epss":0.00674,"percentile":0.51246}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"9c02489cc4237990","cpes":["cpe:2.3:a:libx264-164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264-164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*"],"name":"libx264-164","purl":"pkg:deb/ubuntu/libx264-164@2%3A0.164.3108%2Bgit31e19f9-1?arch=amd64&distro=ubuntu-24.04&upstream=x264","type":"deb","version":"2:0.164.3108+git31e19f9-1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","ISC","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx264-164/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libx264-164/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"x264"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x264","version":"2:0.164.3108+git31e19f9-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-19","epss":0.00672,"percentile":0.51181}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-19","epss":0.00671,"percentile":0.51129}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"risk":0.3255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-19","epss":0.00651,"percentile":0.50247}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31755","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31755","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-10-19","epss":0.00648,"percentile":0.50107}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31755"},"relatedVulnerabilities":[{"id":"CVE-2024-31755","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31755","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31755","date":"2026-10-19","epss":0.00648,"percentile":0.50107}],"urls":["https://github.com/DaveGamble/cJSON/issues/839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31755","description":"cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-19","epss":0.00647,"percentile":0.50046}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67216","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-19","epss":0.00645,"percentile":0.49977}],"risk":0.3225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67216"},"relatedVulnerabilities":[{"id":"CVE-2026-67216","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-19","epss":0.00645,"percentile":0.49977}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-19","epss":0.00642,"percentile":0.49831}],"risk":0.321,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-19","epss":0.00642,"percentile":0.49831}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-19","epss":0.00642,"percentile":0.49831}],"risk":0.321,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-19","epss":0.00642,"percentile":0.49831}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52194","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52194","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52194","date":"2026-10-19","epss":0.00628,"percentile":0.4909}],"risk":0.314,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52194"},"relatedVulnerabilities":[{"id":"CVE-2025-52194","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52194","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52194","date":"2026-10-19","epss":0.00628,"percentile":0.4909}],"urls":["https://bushido-sec.com/index.php/2025/08/08/libsndfile-buffer-overflow/","https://github.com/libsndfile","https://github.com/libsndfile/libsndfile/issues/1082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52194","description":"A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-19","epss":0.0062,"percentile":0.48737}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-19","epss":0.0062,"percentile":0.48737}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-19","epss":0.0062,"percentile":0.48737}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-19","epss":0.0062,"percentile":0.48737}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-19","epss":0.0061,"percentile":0.48204}],"risk":0.305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-19","epss":0.0061,"percentile":0.48204}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-19","epss":0.0061,"percentile":0.48204}],"risk":0.305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-19","epss":0.0061,"percentile":0.48204}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-19","epss":0.00599,"percentile":0.47665}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34875","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34875","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34875","date":"2026-10-19","epss":0.00598,"percentile":0.47614}],"risk":0.299,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34875"},"relatedVulnerabilities":[{"id":"CVE-2026-34875","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34875","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34875","date":"2026-10-19","epss":0.00598,"percentile":0.47614}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-buffer-overflow/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34875","description":"An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-19","epss":0.00588,"percentile":0.47092}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-19","epss":0.00588,"percentile":0.47092}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-19","epss":0.00586,"percentile":0.46993}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-19","epss":0.00586,"percentile":0.46993}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-19","epss":0.00584,"percentile":0.46864}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-19","epss":0.0058,"percentile":0.46652}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-19","epss":0.00556,"percentile":0.45249}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-19","epss":0.00553,"percentile":0.45103}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-19","epss":0.00553,"percentile":0.45103}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"risk":0.2745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"2402c1fe6de1ed42","cpes":["cpe:2.3:a:libpocketsphinx3:libpocketsphinx3:0.8.0\\+real5prealpha\\+1-15ubuntu5:*:*:*:*:*:*:*"],"name":"libpocketsphinx3","purl":"pkg:deb/ubuntu/libpocketsphinx3@0.8.0%2Breal5prealpha%2B1-15ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=pocketsphinx","type":"deb","version":"0.8.0+real5prealpha+1-15ubuntu5","language":"","licenses":["BSD-2","BSD-3-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpocketsphinx3/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpocketsphinx3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpocketsphinx3:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpocketsphinx3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pocketsphinx"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pocketsphinx","version":"0.8.0+real5prealpha+1-15ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54559","cwe":"CWE-119","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54559","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54559","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54559","date":"2026-10-19","epss":0.00548,"percentile":0.44758}],"risk":0.27399999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54559"},"relatedVulnerabilities":[{"id":"CVE-2026-54559","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54559","cwe":"CWE-119","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54559","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54559","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54559","date":"2026-10-19","epss":0.00548,"percentile":0.44758}],"urls":["https://github.com/cmusphinx/pocketsphinx/commit/2a3c03788a9973eff548664334fb781e9f4ad4a5","https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1","https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54559","description":"PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx 5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version 5.1.1."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-48965","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-10-19","epss":0.00535,"percentile":0.43953}],"risk":0.26749999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48965"},"relatedVulnerabilities":[{"id":"CVE-2025-48965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48965","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-48965","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-48965","date":"2026-10-19","epss":0.00535,"percentile":0.43953}],"urls":["https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48965","description":"Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-25833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-25833","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-10-19","epss":0.00527,"percentile":0.43486}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-25833"},"relatedVulnerabilities":[{"id":"CVE-2026-25833","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25833","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-25833","date":"2026-10-19","epss":0.00527,"percentile":0.43486}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25833","description":"Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function"}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87933","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-10-19","epss":0.00527,"percentile":0.43469}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87933"},"relatedVulnerabilities":[{"id":"CVE-2026-87933","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87933","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-87933","cwe":"CWE-416","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-87933","date":"2026-10-19","epss":0.00527,"percentile":0.43469}],"urls":["https://github.com/DaveGamble/cJSON/","https://github.com/DaveGamble/cJSON/issues/1060","https://github.com/DaveGamble/cJSON/pull/1065","https://vuldb.com/cve/CVE-2026-87933","https://vuldb.com/submit/911136","https://vuldb.com/vuln/401815","https://vuldb.com/vuln/401815/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87933","description":"A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-19","epss":0.00524,"percentile":0.43254}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-19","epss":0.00521,"percentile":0.43048}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3a1734a09749ac23","cpes":["cpe:2.3:a:libslang2:libslang2:2.3.3-3build2:*:*:*:*:*:*:*"],"name":"libslang2","purl":"pkg:deb/ubuntu/libslang2@2.3.3-3build2?arch=amd64&distro=ubuntu-24.04&upstream=slang2","type":"deb","version":"2.3.3-3build2","language":"","licenses":["GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libslang2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libslang2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libslang2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libslang2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"slang2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-45927","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"slang2","version":"2.3.3-3build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-45927","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-45927","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45927","date":"2026-10-19","epss":0.00844,"percentile":0.57272}],"risk":0.2532,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-45927"},"relatedVulnerabilities":[{"id":"CVE-2023-45927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45927","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45927","date":"2026-10-19","epss":0.00844,"percentile":0.57272}],"urls":["http://lists.jedsoft.org/lists/slang-users/2023/0000003.html","https://seclists.org/fulldisclosure/2024/Jan/55","http://seclists.org/fulldisclosure/2024/Jan/55"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45927","description":"S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf()."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-19","epss":0.00506,"percentile":0.41969}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-37555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-37555","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-19","epss":0.00504,"percentile":0.41858}],"risk":0.252,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-37555"},"relatedVulnerabilities":[{"id":"CVE-2026-37555","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-19","epss":0.00504,"percentile":0.41858}],"urls":["https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1","https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","https://github.com/libsndfile/libsndfile/issues/833","https://access.redhat.com/errata/RHSA-2026:19559","https://access.redhat.com/errata/RHSA-2026:19560","https://access.redhat.com/errata/RHSA-2026:19610","https://access.redhat.com/errata/RHSA-2026:23221","https://access.redhat.com/errata/RHSA-2026:23222","https://access.redhat.com/errata/RHSA-2026:23223","https://access.redhat.com/errata/RHSA-2026:25092","https://access.redhat.com/errata/RHSA-2026:25197","https://access.redhat.com/errata/RHSA-2026:25198","https://access.redhat.com/errata/RHSA-2026:25227","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/security/cve/CVE-2026-37555","https://bugzilla.redhat.com/show_bug.cgi?id=2463856","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-10-19","epss":0.00499,"percentile":0.415}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34876"},"relatedVulnerabilities":[{"id":"CVE-2026-34876","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34876","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34876","date":"2026-10-19","epss":0.00499,"percentile":0.415}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/","https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34876","description":"An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-19","epss":0.00496,"percentile":0.41308}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34874","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-10-19","epss":0.00488,"percentile":0.40689}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34874"},"relatedVulnerabilities":[{"id":"CVE-2026-34874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34874","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34874","date":"2026-10-19","epss":0.00488,"percentile":0.40689}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34874","description":"An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-1000520","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-10-19","epss":0.00799,"percentile":0.5578}],"risk":0.23970000000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000520"},"relatedVulnerabilities":[{"id":"CVE-2018-1000520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000520","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000520","date":"2026-10-19","epss":0.00799,"percentile":0.5578}],"urls":["https://github.com/ARMmbed/mbedtls/issues/1561"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000520","description":"ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted.."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-19","epss":0.00466,"percentile":0.3896}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-19","epss":0.0046,"percentile":0.38547}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-19","epss":0.0046,"percentile":0.38544}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-19","epss":0.00458,"percentile":0.3834}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-19","epss":0.00454,"percentile":0.38066}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-29036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-29036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-10-19","epss":0.00444,"percentile":0.37202}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-29036"},"relatedVulnerabilities":[{"id":"CVE-2026-29036","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-29036","cwe":"CWE-706","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-29036","date":"2026-10-19","epss":0.00444,"percentile":0.37202}],"urls":["https://github.com/DaveGamble/cJSON","https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29036","description":"cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-19","epss":0.00443,"percentile":0.37162}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"d13962db411674ab","cpes":["cpe:2.3:a:libcjson1:libcjson1:1.7.17-1:*:*:*:*:*:*:*"],"name":"libcjson1","purl":"pkg:deb/ubuntu/libcjson1@1.7.17-1?arch=amd64&distro=ubuntu-24.04&upstream=cjson","type":"deb","version":"1.7.17-1","language":"","licenses":["Apache-2.0","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcjson1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libcjson1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libcjson1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cjson"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cjson","version":"1.7.17-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-19","epss":0.00433,"percentile":0.36209}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67217"},"relatedVulnerabilities":[{"id":"CVE-2026-67217","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-19","epss":0.00433,"percentile":0.36209}],"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-19","epss":0.00433,"percentile":0.362}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-19","epss":0.00433,"percentile":0.362}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"3a1734a09749ac23","cpes":["cpe:2.3:a:libslang2:libslang2:2.3.3-3build2:*:*:*:*:*:*:*"],"name":"libslang2","purl":"pkg:deb/ubuntu/libslang2@2.3.3-3build2?arch=amd64&distro=ubuntu-24.04&upstream=slang2","type":"deb","version":"2.3.3-3build2","language":"","licenses":["GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libslang2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libslang2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libslang2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libslang2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"slang2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-45929","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"slang2","version":"2.3.3-3build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-45929","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-45929","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45929","date":"2026-10-19","epss":0.0071,"percentile":0.5266}],"risk":0.213,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-45929"},"relatedVulnerabilities":[{"id":"CVE-2023-45929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45929","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-45929","date":"2026-10-19","epss":0.0071,"percentile":0.5266}],"urls":["http://lists.jedsoft.org/lists/slang-users/2023/0000002.html","http://seclists.org/fulldisclosure/2024/Jan/57"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45929","description":"S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr()."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-19","epss":0.00422,"percentile":0.35169}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-19","epss":0.00422,"percentile":0.35109}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"60cd399e27aca55c","cpes":["cpe:2.3:a:libmbedcrypto7t64:libmbedcrypto7t64:2.28.8-1:*:*:*:*:*:*:*"],"name":"libmbedcrypto7t64","purl":"pkg:deb/ubuntu/libmbedcrypto7t64@2.28.8-1?arch=amd64&distro=ubuntu-24.04&upstream=mbedtls","type":"deb","version":"2.28.8-1","language":"","licenses":["Apache-2.0","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmbedcrypto7t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libmbedcrypto7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libmbedcrypto7t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mbedtls"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34873","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mbedtls","version":"2.28.8-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34873","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34873","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34873","date":"2026-10-19","epss":0.0042,"percentile":0.34961}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34873"},"relatedVulnerabilities":[{"id":"CVE-2026-34873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34873","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34873","date":"2026-10-19","epss":0.0042,"percentile":0.34961}],"urls":["https://mbed-tls.readthedocs.io/en/latest/security-advisories/","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34873","description":"An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-19","epss":0.00416,"percentile":0.34517}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-19","epss":0.00416,"percentile":0.34496}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"a2f9719e177cea19","cpes":["cpe:2.3:a:python_software_foundation:python:3.14.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.14.8:*:*:*:*:*:*:*"],"name":"python","purl":"pkg:generic/python@3.14.8","type":"binary","version":"3.14.8","language":"","licenses":[],"locations":[{"path":"/usr/local/bin/python3.14","layerID":"sha256:e4f4ad7ef826f93a56a4b196a59fd22eea6335a191e03f3c3846b5d9ca4f48cc","accessPath":"/usr/local/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/libpython3.14.so.1.0","layerID":"sha256:e4f4ad7ef826f93a56a4b196a59fd22eea6335a191e03f3c3846b5d9ca4f48cc","accessPath":"/usr/local/lib/libpython3.14.so.1.0","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.14.8:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.14.8"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"3.15.0a6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.14.8:*:*:*:*:*:*:*"],"package":{"name":"python","version":"3.14.8"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"fixed","versions":["3.15.0a6"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"3.15.0a6"},{"date":"2026-03-03","kind":"first-observed","version":"3.15.0a6"}]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-19","epss":0.00377,"percentile":0.30201}],"risk":0.20546500000000004,"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"f7eca80653a08715","cpes":["cpe:2.3:a:libjxl0.7:libjxl0.7:0.7.0-10.2ubuntu6.1:*:*:*:*:*:*:*"],"name":"libjxl0.7","purl":"pkg:deb/ubuntu/libjxl0.7@0.7.0-10.2ubuntu6.1?arch=amd64&distro=ubuntu-24.04&upstream=jpeg-xl","type":"deb","version":"0.7.0-10.2ubuntu6.1","language":"","licenses":["BSD-3-clause-Google","ISC-License"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjxl0.7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libjxl0.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"jpeg-xl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"jpeg-xl","version":"0.7.0-10.2ubuntu6.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-19","epss":0.00407,"percentile":0.33553}],"risk":0.2035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82522"},"relatedVulnerabilities":[{"id":"CVE-2026-82522","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-19","epss":0.00407,"percentile":0.33553}],"urls":["https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68","https://github.com/libjxl/libjxl/pull/4885","https://github.com/libjxl/libjxl/releases/tag/v0.12.0","https://www.vulncheck.com/advisories/libjxl-container-box-parser-integer-underflow-via-32-bit-size-truncation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82522","description":"libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-19","epss":0.00403,"percentile":0.3313}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-19","epss":0.00403,"percentile":0.3313}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"84189c52cc07ec75","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-19","epss":0.00665,"percentile":0.50874}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-19","epss":0.00665,"percentile":0.50874}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-19","epss":0.00396,"percentile":0.32372}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-19","epss":0.00391,"percentile":0.31692}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88372","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-19","epss":0.0039,"percentile":0.31597}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88372"},"relatedVulnerabilities":[{"id":"CVE-2026-88372","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-19","epss":0.0039,"percentile":0.31597}],"urls":["https://github.com/libsndfile/libsndfile/issues/1151"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109828","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109828","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109828","cwe":"CWE-453","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-109828","cwe":"CWE-457","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-109828","date":"2026-10-19","epss":0.00386,"percentile":0.31237}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109828"},"relatedVulnerabilities":[{"id":"CVE-2026-109828","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109828","cwe":"CWE-453","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-109828","cwe":"CWE-457","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-109828","date":"2026-10-19","epss":0.00386,"percentile":0.31237}],"urls":["https://github.com/libsndfile/libsndfile/","https://github.com/libsndfile/libsndfile/issues/1169","https://vuldb.com/cve/CVE-2026-109828","https://vuldb.com/submit/1002209","https://vuldb.com/vuln/417466","https://vuldb.com/vuln/417466/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109828","description":"A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-19","epss":0.00386,"percentile":0.31141}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-19","epss":0.00384,"percentile":0.30943}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-19","epss":0.00375,"percentile":0.29955}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-19","epss":0.00374,"percentile":0.29856}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"48c25b3d5d16986c","cpes":["cpe:2.3:a:libswscale7:libswscale7:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswscale7","purl":"pkg:deb/ubuntu/libswscale7@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswscale7/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libswscale7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libswscale7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-19","epss":0.00372,"percentile":0.29667}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"39d401da08ef68f7","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:deb/ubuntu/ffmpeg@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ffmpeg/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/ffmpeg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ffmpeg.list","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/ffmpeg.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"61476235877caa35","cpes":["cpe:2.3:a:libavdevice60:libavdevice60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavdevice60","purl":"pkg:deb/ubuntu/libavdevice60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavdevice60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavdevice60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavdevice60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6615a8574fceb2e6","cpes":["cpe:2.3:a:libavfilter9:libavfilter9:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavfilter9","purl":"pkg:deb/ubuntu/libavfilter9@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavfilter9/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavfilter9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavfilter9:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"c60ae1ae50ec6582","cpes":["cpe:2.3:a:libavformat60:libavformat60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavformat60","purl":"pkg:deb/ubuntu/libavformat60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavformat60/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavformat60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavformat60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"eb624053a8d145e1","cpes":["cpe:2.3:a:libpostproc57:libpostproc57:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libpostproc57","purl":"pkg:deb/ubuntu/libpostproc57@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpostproc57/copyright","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/usr/share/doc/libpostproc57/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","layerID":"sha256:4112bd49e1245b6d5c84af9667c92062e722b5020f1588bdccbd5ce54ebbb4fb","accessPath":"/var/lib/dpkg/info/libpostproc57:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-19","epss":0.00368,"percentile":0.29176}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]}],"grade":"A","score":"100.00","as_of":"2026-10-21T06:18:29.070Z","grype_db_version":"2026-10-20T06:29:49.000Z"}