{"grype_matches":[{"artifact":{"id":"60b4bba07af9d4a3","cpes":["cpe:2.3:a:ldb:ldb:4.23.8-r0:*:*:*:*:*:*:*"],"name":"ldb","purl":"pkg:apk/alpine/ldb@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libldb.so.2"},{"path":"/usr/lib/libldb.so.2.11.0"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libldb-key-value-private-samba.so"},{"path":"/usr/lib/samba/libldb-mdb-int-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-err-map-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-int-private-samba.so"},{"path":"/usr/lib/samba/ldb"},{"path":"/usr/lib/samba/ldb/asq.so"},{"path":"/usr/lib/samba/ldb/ldb.so"},{"path":"/usr/lib/samba/ldb/mdb.so"},{"path":"/usr/lib/samba/ldb/paged_searches.so"},{"path":"/usr/lib/samba/ldb/rdn_name.so"},{"path":"/usr/lib/samba/ldb/sample.so"},{"path":"/usr/lib/samba/ldb/server_sort.so"},{"path":"/usr/lib/samba/ldb/skel.so"},{"path":"/usr/lib/samba/ldb/tdb.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"e7fc857bec58ca2f","cpes":["cpe:2.3:a:libauth-samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth-samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libauth-samba","purl":"pkg:apk/alpine/libauth-samba@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libauth-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"f821b370fe0549c8","cpes":["cpe:2.3:a:libsmbclient:libsmbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libsmbclient","purl":"pkg:apk/alpine/libsmbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsmbclient.so.0"},{"path":"/usr/lib/libsmbclient.so.0.8.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"48b3721c92eb0a22","cpes":["cpe:2.3:a:libwbclient:libwbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libwbclient","purl":"pkg:apk/alpine/libwbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libwbclient.so.0"},{"path":"/usr/lib/libwbclient.so.0.16"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac10ab65fc7d9ce4","cpes":["cpe:2.3:a:samba-client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client","purl":"pkg:apk/alpine/samba-client@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/cifsdd"},{"path":"/usr/bin/dbwrap_tool"},{"path":"/usr/bin/dumpmscat"},{"path":"/usr/bin/mdsearch"},{"path":"/usr/bin/mvxattr"},{"path":"/usr/bin/nmblookup"},{"path":"/usr/bin/oLschema2ldif"},{"path":"/usr/bin/regdiff"},{"path":"/usr/bin/regpatch"},{"path":"/usr/bin/regshell"},{"path":"/usr/bin/regtree"},{"path":"/usr/bin/rpcclient"},{"path":"/usr/bin/samba-regedit"},{"path":"/usr/bin/sharesec"},{"path":"/usr/bin/smbcacls"},{"path":"/usr/bin/smbclient"},{"path":"/usr/bin/smbcquotas"},{"path":"/usr/bin/smbget"},{"path":"/usr/bin/smbprint"},{"path":"/usr/bin/smbspool"},{"path":"/usr/bin/smbtar"},{"path":"/usr/bin/smbtree"},{"path":"/usr/bin/wspsearch"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/smbspool_krb5_wrapper"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"0653ff05925e1977","cpes":["cpe:2.3:a:samba-client-libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client-libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client-libs","purl":"pkg:apk/alpine/samba-client-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc.so.0"},{"path":"/usr/lib/libdcerpc.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libad-claims-private-samba.so"},{"path":"/usr/lib/samba/libauthn-policy-util-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-contexts-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-garbage-collect-tombstones-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-module-private-samba.so"},{"path":"/usr/lib/samba/libgpo-private-samba.so"},{"path":"/usr/lib/samba/libhttp-private-samba.so"},{"path":"/usr/lib/samba/libmscat-private-samba.so"},{"path":"/usr/lib/samba/libnetif-private-samba.so"},{"path":"/usr/lib/samba/libprinter-driver-private-samba.so"},{"path":"/usr/lib/samba/libregistry-private-samba.so"},{"path":"/usr/lib/samba/libsmbclient-raw-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"3126191b0742dcfd","cpes":["cpe:2.3:a:samba-common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_common:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-common","purl":"pkg:apk/alpine/samba-common@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/samba"},{"path":"/etc/samba"},{"path":"/etc/samba/smb.conf"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/samba"},{"path":"/var/lib"},{"path":"/var/lib/samba"},{"path":"/var/lib/samba/bind-dns"},{"path":"/var/lib/samba/private"},{"path":"/var/lib/samba/sysvol"},{"path":"/var/log"},{"path":"/var/log/samba"},{"path":"/var/run"},{"path":"/var/run/samba"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ad68879ae8acc288","cpes":["cpe:2.3:a:samba-libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-libs","purl":"pkg:apk/alpine/samba-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc-binding.so.0"},{"path":"/usr/lib/libdcerpc-binding.so.0.0.1"},{"path":"/usr/lib/libndr-krb5pac.so.0"},{"path":"/usr/lib/libndr-krb5pac.so.0.0.1"},{"path":"/usr/lib/libndr-nbt.so.0"},{"path":"/usr/lib/libndr-nbt.so.0.0.1"},{"path":"/usr/lib/libndr-standard.so.0"},{"path":"/usr/lib/libndr-standard.so.0.0.1"},{"path":"/usr/lib/libndr.so.6"},{"path":"/usr/lib/libndr.so.6.0.0"},{"path":"/usr/lib/libsamba-credentials.so.1"},{"path":"/usr/lib/libsamba-credentials.so.1.0.0"},{"path":"/usr/lib/libsamba-errors.so.1"},{"path":"/usr/lib/libsamba-errors.so.1.0.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0.0.1"},{"path":"/usr/lib/libsamba-passdb.so.0"},{"path":"/usr/lib/libsamba-passdb.so.0.30.0"},{"path":"/usr/lib/libsamdb.so.0"},{"path":"/usr/lib/libsamdb.so.0.0.1"},{"path":"/usr/lib/libsmbconf.so.0"},{"path":"/usr/lib/libsmbconf.so.0.0.1"},{"path":"/usr/lib/libsmbldap.so.2"},{"path":"/usr/lib/libsmbldap.so.2.1.0"},{"path":"/usr/lib/libtevent-util.so.0"},{"path":"/usr/lib/libtevent-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libCHARSET3-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-SEND-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-private-samba.so"},{"path":"/usr/lib/samba/libaddns-private-samba.so"},{"path":"/usr/lib/samba/libads-private-samba.so"},{"path":"/usr/lib/samba/libasn1-private-samba.so"},{"path":"/usr/lib/samba/libasn1util-private-samba.so"},{"path":"/usr/lib/samba/libauthkrb5-private-samba.so"},{"path":"/usr/lib/samba/libcli-cldap-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-nbt-private-samba.so"},{"path":"/usr/lib/samba/libcli-smb-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-spoolss-private-samba.so"},{"path":"/usr/lib/samba/libcliauth-private-samba.so"},{"path":"/usr/lib/samba/libclidns-private-samba.so"},{"path":"/usr/lib/samba/libcluster-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-private-samba.so"},{"path":"/usr/lib/samba/libcmocka-private-samba.so"},{"path":"/usr/lib/samba/libcommon-auth-private-samba.so"},{"path":"/usr/lib/samba/libdbwrap-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-pkt-auth-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-samba-private-samba.so"},{"path":"/usr/lib/samba/libevents-private-samba.so"},{"path":"/usr/lib/samba/libflag-mapping-private-samba.so"},{"path":"/usr/lib/samba/libgensec-private-samba.so"},{"path":"/usr/lib/samba/libgse-private-samba.so"},{"path":"/usr/lib/samba/libgssapi-private-samba.so"},{"path":"/usr/lib/samba/libhcrypto-private-samba.so"},{"path":"/usr/lib/samba/libheimbase-private-samba.so"},{"path":"/usr/lib/samba/libheimntlm-private-samba.so"},{"path":"/usr/lib/samba/libhx509-private-samba.so"},{"path":"/usr/lib/samba/libinterfaces-private-samba.so"},{"path":"/usr/lib/samba/libkrb5-private-samba.so"},{"path":"/usr/lib/samba/libkrb5samba-private-samba.so"},{"path":"/usr/lib/samba/libldbsamba-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-lsa3-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-netlogon3-private-samba.so"},{"path":"/usr/lib/samba/liblibsmb-private-samba.so"},{"path":"/usr/lib/samba/libmessages-dgm-private-samba.so"},{"path":"/usr/lib/samba/libmessages-util-private-samba.so"},{"path":"/usr/lib/samba/libmsghdr-private-samba.so"},{"path":"/usr/lib/samba/libmsrpc3-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba4-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-crypto-gnutls-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-private-samba.so"},{"path":"/usr/lib/samba/libnpa-tstream-private-samba.so"},{"path":"/usr/lib/samba/libquic-private-samba.so"},{"path":"/usr/lib/samba/libroken-private-samba.so"},{"path":"/usr/lib/samba/libsamba-cluster-support-private-samba.so"},{"path":"/usr/lib/samba/libsamba-modules-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-trusts-private-samba.so"},{"path":"/usr/lib/samba/libsamba-sockets-private-samba.so"},{"path":"/usr/lib/samba/libsamba3-util-private-samba.so"},{"path":"/usr/lib/samba/libsamdb-common-private-samba.so"},{"path":"/usr/lib/samba/libsecrets3-private-samba.so"},{"path":"/usr/lib/samba/libserver-id-db-private-samba.so"},{"path":"/usr/lib/samba/libserver-role-private-samba.so"},{"path":"/usr/lib/samba/libsmbd-shim-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-printf-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-private-samba.so"},{"path":"/usr/lib/samba/libtdb-wrap-private-samba.so"},{"path":"/usr/lib/samba/libutil-crypt-private-samba.so"},{"path":"/usr/lib/samba/libutil-reg-private-samba.so"},{"path":"/usr/lib/samba/libutil-setid-private-samba.so"},{"path":"/usr/lib/samba/libutil-tdb-private-samba.so"},{"path":"/usr/lib/samba/libwind-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ff247fd7e527c8e3","cpes":["cpe:2.3:a:samba-util-libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util-libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-util-libs","purl":"pkg:apk/alpine/samba-util-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.2&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsamba-util.so.0"},{"path":"/usr/lib/libsamba-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libcom-err-private-samba.so"},{"path":"/usr/lib/samba/libgenrand-private-samba.so"},{"path":"/usr/lib/samba/libiov-buf-private-samba.so"},{"path":"/usr/lib/samba/libreplace-private-samba.so"},{"path":"/usr/lib/samba/libsamba-debug-private-samba.so"},{"path":"/usr/lib/samba/libsocket-blocking-private-samba.so"},{"path":"/usr/lib/samba/libstable-sort-private-samba.so"},{"path":"/usr/lib/samba/libsys-rw-private-samba.so"},{"path":"/usr/lib/samba/libtime-basic-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-10-19","epss":0.0599,"percentile":0.93239}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"21fc07a6a89f2980","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"2edeb09c64c8690c","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"6c8bfc0ad3d5f9d0","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"75f1683af40fbd28","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"2675867d0355725f","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1d8cffd2bedc00","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"55c3a8ef612bd6f9","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"aec40304b057cd8c","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"2accc72c12311df2","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"4ab5d649af0ea0ed","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"e6658900ba2dafed","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-10-19","epss":0.03738,"percentile":0.8972}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"21fc07a6a89f2980","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2edeb09c64c8690c","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"6c8bfc0ad3d5f9d0","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"75f1683af40fbd28","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2675867d0355725f","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1d8cffd2bedc00","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"55c3a8ef612bd6f9","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"aec40304b057cd8c","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2accc72c12311df2","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"4ab5d649af0ea0ed","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e6658900ba2dafed","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-10-19","epss":0.03371,"percentile":0.88606}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"21fc07a6a89f2980","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2edeb09c64c8690c","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"6c8bfc0ad3d5f9d0","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"75f1683af40fbd28","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2675867d0355725f","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1d8cffd2bedc00","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"55c3a8ef612bd6f9","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"aec40304b057cd8c","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"2accc72c12311df2","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"4ab5d649af0ea0ed","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e6658900ba2dafed","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.30-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.30-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.30-r0?arch=x86_64&distro=alpine-3.24.2&upstream=imagemagick","type":"apk","version":"7.1.2.30-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.30:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.30-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-10-19","epss":0.02071,"percentile":0.81149}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"5702a5a741fd2780","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.07.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:artifex:ghostscript:10.07.1-r0:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:apk/alpine/ghostscript@10.07.1-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"10.07.1-r0","language":"","licenses":["AGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/dvipdf"},{"path":"/usr/bin/eps2eps"},{"path":"/usr/bin/gs"},{"path":"/usr/bin/gsbj"},{"path":"/usr/bin/gsc"},{"path":"/usr/bin/gsdj"},{"path":"/usr/bin/gsdj500"},{"path":"/usr/bin/gslj"},{"path":"/usr/bin/gslp"},{"path":"/usr/bin/gsnd"},{"path":"/usr/bin/ijs_client_example"},{"path":"/usr/bin/ijs_server_example"},{"path":"/usr/bin/lprsetup.sh"},{"path":"/usr/bin/pdf2dsc"},{"path":"/usr/bin/pdf2ps"},{"path":"/usr/bin/pf2afm"},{"path":"/usr/bin/pfbtopfa"},{"path":"/usr/bin/pphs"},{"path":"/usr/bin/printafm"},{"path":"/usr/bin/ps2ascii"},{"path":"/usr/bin/ps2epsi"},{"path":"/usr/bin/ps2pdf"},{"path":"/usr/bin/ps2pdf12"},{"path":"/usr/bin/ps2pdf13"},{"path":"/usr/bin/ps2pdf14"},{"path":"/usr/bin/ps2pdfwr"},{"path":"/usr/bin/ps2ps"},{"path":"/usr/bin/ps2ps2"},{"path":"/usr/bin/unix-lpr.sh"},{"path":"/usr/lib"},{"path":"/usr/lib/libgs.so.10"},{"path":"/usr/lib/libgs.so.10.07"},{"path":"/usr/lib/libijs-0.35.so"},{"path":"/usr/share"},{"path":"/usr/share/fonts"},{"path":"/usr/share/fonts/Type1"},{"path":"/usr/share/ghostscript"},{"path":"/usr/share/ghostscript/Resource"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst/DroidSansFallback.ttf"},{"path":"/usr/share/ghostscript/Resource/CIDFont"},{"path":"/usr/share/ghostscript/Resource/CIDFont/ArtifexBullet"},{"path":"/usr/share/ghostscript/Resource/CMap"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/83pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-7"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan2-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hankaku"},{"path":"/usr/share/ghostscript/Resource/CMap/Hiragana"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Katakana"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-H"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-V"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Roman"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/V"},{"path":"/usr/share/ghostscript/Resource/CMap/WP-Symbol"},{"path":"/usr/share/ghostscript/Resource/ColorSpace"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultRGB"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/TrivialCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sRGB"},{"path":"/usr/share/ghostscript/Resource/Decoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Dingbats"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Symbol"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Unicode"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Wingdings"},{"path":"/usr/share/ghostscript/Resource/Decoding/Latin1"},{"path":"/usr/share/ghostscript/Resource/Decoding/StandardEncoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/Unicode"},{"path":"/usr/share/ghostscript/Resource/Encoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/CEEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertSubsetEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/NotDefEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/Wingdings"},{"path":"/usr/share/ghostscript/Resource/Font"},{"path":"/usr/share/ghostscript/Resource/Font/C059-BdIta"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/D050000L"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-BoldOblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Oblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/P052-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/StandardSymbolsPS"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-DemiItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Light"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-LightItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Book"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-BookOblique"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-DemiOblique"},{"path":"/usr/share/ghostscript/Resource/Font/Z003-MediumItalic"},{"path":"/usr/share/ghostscript/Resource/IdiomSet"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/PPI_CUtils"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/Pscript5Idiom"},{"path":"/usr/share/ghostscript/Resource/Init"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIcidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIconfig"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIfontmap"},{"path":"/usr/share/ghostscript/Resource/Init/FCOfontmap-PCLPS2"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap.GS"},{"path":"/usr/share/ghostscript/Resource/Init/cidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/gs_agl.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_btokn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cet.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cff.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidcm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ciddc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidtt.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cmap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cspace.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dbt_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_diskn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dscp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_epsf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fapi.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fntem.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fonts.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_frsd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_icc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_il1_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_img.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_init.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_lev2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ll3.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mex_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mgl_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mro_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdf_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdfwr.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_res.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_resmp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_setpd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_statd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_std_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_sym_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_trap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ttf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ32.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ42.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_type1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_wan_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/pdf_main.ps"},{"path":"/usr/share/ghostscript/Resource/Init/xlatmap"},{"path":"/usr/share/ghostscript/Resource/SubstCID"},{"path":"/usr/share/ghostscript/Resource/SubstCID/CNS1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/GB1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Japan1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Korea1-WMode"},{"path":"/usr/share/ghostscript/iccprofiles"},{"path":"/usr/share/ghostscript/iccprofiles/a98.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/esrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/gray_to_k.icc"},{"path":"/usr/share/ghostscript/iccprofiles/lab.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/rommrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/scrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/sgray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/srgb.icc"},{"path":"/usr/share/ghostscript/lib"},{"path":"/usr/share/ghostscript/lib/PDFA_def.ps"},{"path":"/usr/share/ghostscript/lib/PDFX_def.ps"},{"path":"/usr/share/ghostscript/lib/PM760p.upp"},{"path":"/usr/share/ghostscript/lib/PM760pl.upp"},{"path":"/usr/share/ghostscript/lib/PM820p.upp"},{"path":"/usr/share/ghostscript/lib/PM820pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc670p.upp"},{"path":"/usr/share/ghostscript/lib/Stc670pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc680p.upp"},{"path":"/usr/share/ghostscript/lib/Stc680pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc740p.upp"},{"path":"/usr/share/ghostscript/lib/Stc740pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc760p.upp"},{"path":"/usr/share/ghostscript/lib/Stc760pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc777p.upp"},{"path":"/usr/share/ghostscript/lib/Stc777pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp720p.upp"},{"path":"/usr/share/ghostscript/lib/Stp720pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp870p.upp"},{"path":"/usr/share/ghostscript/lib/Stp870pl.upp"},{"path":"/usr/share/ghostscript/lib/acctest.ps"},{"path":"/usr/share/ghostscript/lib/align.ps"},{"path":"/usr/share/ghostscript/lib/bj8.rpd"},{"path":"/usr/share/ghostscript/lib/bj8gc12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8hg12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8oh06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pa06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pp12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8ts06n.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a0.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a5.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a8.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b8.upp"},{"path":"/usr/share/ghostscript/lib/caption.ps"},{"path":"/usr/share/ghostscript/lib/cbjc600.ppd"},{"path":"/usr/share/ghostscript/lib/cbjc800.ppd"},{"path":"/usr/share/ghostscript/lib/cdj550.upp"},{"path":"/usr/share/ghostscript/lib/cdj690.upp"},{"path":"/usr/share/ghostscript/lib/cdj690ec.upp"},{"path":"/usr/share/ghostscript/lib/cid2code.ps"},{"path":"/usr/share/ghostscript/lib/dnj750c.upp"},{"path":"/usr/share/ghostscript/lib/dnj750m.upp"},{"path":"/usr/share/ghostscript/lib/docie.ps"},{"path":"/usr/share/ghostscript/lib/font2pcl.ps"},{"path":"/usr/share/ghostscript/lib/ghostpdf.ppd"},{"path":"/usr/share/ghostscript/lib/gs_ce_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_css_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_il2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_kanji.ps"},{"path":"/usr/share/ghostscript/lib/gs_ksb_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_l.xbm"},{"path":"/usr/share/ghostscript/lib/gs_l.xpm"},{"path":"/usr/share/ghostscript/lib/gs_l_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_lgo_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_lgx_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_m.xpm"},{"path":"/usr/share/ghostscript/lib/gs_m_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xpm"},{"path":"/usr/share/ghostscript/lib/gs_s_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xpm"},{"path":"/usr/share/ghostscript/lib/gs_t_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_wl1_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl5_e.ps"},{"path":"/usr/share/ghostscript/lib/gslp.ps"},{"path":"/usr/share/ghostscript/lib/gsnup.ps"},{"path":"/usr/share/ghostscript/lib/ht_ccsto.ps"},{"path":"/usr/share/ghostscript/lib/image-qa.ps"},{"path":"/usr/share/ghostscript/lib/jispaper.ps"},{"path":"/usr/share/ghostscript/lib/landscap.ps"},{"path":"/usr/share/ghostscript/lib/lines.ps"},{"path":"/usr/share/ghostscript/lib/mkcidfm.ps"},{"path":"/usr/share/ghostscript/lib/necp2x.upp"},{"path":"/usr/share/ghostscript/lib/necp2x6.upp"},{"path":"/usr/share/ghostscript/lib/pdf2dsc.ps"},{"path":"/usr/share/ghostscript/lib/pdf_info.ps"},{"path":"/usr/share/ghostscript/lib/pf2afm.ps"},{"path":"/usr/share/ghostscript/lib/pfbtopfa.ps"},{"path":"/usr/share/ghostscript/lib/ppath.ps"},{"path":"/usr/share/ghostscript/lib/pphs.ps"},{"path":"/usr/share/ghostscript/lib/prfont.ps"},{"path":"/usr/share/ghostscript/lib/printafm.ps"},{"path":"/usr/share/ghostscript/lib/ps2ai.ps"},{"path":"/usr/share/ghostscript/lib/ps2epsi.ps"},{"path":"/usr/share/ghostscript/lib/ras1.upp"},{"path":"/usr/share/ghostscript/lib/ras24.upp"},{"path":"/usr/share/ghostscript/lib/ras3.upp"},{"path":"/usr/share/ghostscript/lib/ras32.upp"},{"path":"/usr/share/ghostscript/lib/ras4.upp"},{"path":"/usr/share/ghostscript/lib/ras8m.upp"},{"path":"/usr/share/ghostscript/lib/rollconv.ps"},{"path":"/usr/share/ghostscript/lib/s400a1.upp"},{"path":"/usr/share/ghostscript/lib/s400b1.upp"},{"path":"/usr/share/ghostscript/lib/sharp.upp"},{"path":"/usr/share/ghostscript/lib/sipixa6.upp"},{"path":"/usr/share/ghostscript/lib/st640ih.upp"},{"path":"/usr/share/ghostscript/lib/st640ihg.upp"},{"path":"/usr/share/ghostscript/lib/st640p.upp"},{"path":"/usr/share/ghostscript/lib/st640pg.upp"},{"path":"/usr/share/ghostscript/lib/st640pl.upp"},{"path":"/usr/share/ghostscript/lib/st640plg.upp"},{"path":"/usr/share/ghostscript/lib/stc.upp"},{"path":"/usr/share/ghostscript/lib/stc1520h.upp"},{"path":"/usr/share/ghostscript/lib/stc2.upp"},{"path":"/usr/share/ghostscript/lib/stc200_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2s_h.upp"},{"path":"/usr/share/ghostscript/lib/stc300.upp"},{"path":"/usr/share/ghostscript/lib/stc300bl.upp"},{"path":"/usr/share/ghostscript/lib/stc300bm.upp"},{"path":"/usr/share/ghostscript/lib/stc500p.upp"},{"path":"/usr/share/ghostscript/lib/stc500ph.upp"},{"path":"/usr/share/ghostscript/lib/stc600ih.upp"},{"path":"/usr/share/ghostscript/lib/stc600p.upp"},{"path":"/usr/share/ghostscript/lib/stc600pl.upp"},{"path":"/usr/share/ghostscript/lib/stc640p.upp"},{"path":"/usr/share/ghostscript/lib/stc740ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800p.upp"},{"path":"/usr/share/ghostscript/lib/stc800pl.upp"},{"path":"/usr/share/ghostscript/lib/stc_h.upp"},{"path":"/usr/share/ghostscript/lib/stc_l.upp"},{"path":"/usr/share/ghostscript/lib/stcany.upp"},{"path":"/usr/share/ghostscript/lib/stcany_h.upp"},{"path":"/usr/share/ghostscript/lib/stcinfo.ps"},{"path":"/usr/share/ghostscript/lib/stcolor.ps"},{"path":"/usr/share/ghostscript/lib/stocht.ps"},{"path":"/usr/share/ghostscript/lib/traceimg.ps"},{"path":"/usr/share/ghostscript/lib/traceop.ps"},{"path":"/usr/share/ghostscript/lib/uninfo.ps"},{"path":"/usr/share/ghostscript/lib/viewcmyk.ps"},{"path":"/usr/share/ghostscript/lib/viewgif.ps"},{"path":"/usr/share/ghostscript/lib/viewjpeg.ps"},{"path":"/usr/share/ghostscript/lib/viewmiff.ps"},{"path":"/usr/share/ghostscript/lib/viewpbm.ps"},{"path":"/usr/share/ghostscript/lib/viewpcx.ps"},{"path":"/usr/share/ghostscript/lib/viewps2a.ps"},{"path":"/usr/share/ghostscript/lib/winmaps.ps"},{"path":"/usr/share/ghostscript/lib/zeroline.ps"},{"path":"/usr/share/ghostscript/lib/zugferd.ps"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ghostscript"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.08.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.08.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"ghostscript","version":"10.07.1-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"10.08.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39919","versionConstraint":"< 10.08.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"ghostscript","version":"10.07.1-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-39919","fix":{"state":"fixed","versions":["10.08.0-r0"],"available":[{"date":"2026-10-16","kind":"first-observed","version":"10.08.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-19","epss":0.00784,"percentile":0.55266}],"risk":0.71736,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-39919"},"relatedVulnerabilities":[{"id":"CVE-2026-39919","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39919","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-39919","date":"2026-10-19","epss":0.00784,"percentile":0.55266}],"urls":["https://bugs.ghostscript.com/show_bug.cgi?id=709666","https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution."}]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64831","versionConstraint":">= 8.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64831","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64831","cwe":"CWE-121","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64831","date":"2026-10-19","epss":0.00851,"percentile":0.57515}],"risk":0.6914375,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665","https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64831","description":"FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.2&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-1236","versionConstraint":"< 3.0.0.4112 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-1236","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-1236","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-1236","date":"2026-10-19","epss":0.01365,"percentile":0.71393}],"risk":0.634725,"urls":["http://code.google.com/p/chromium/issues/detail?id=37383","http://codereview.chromium.org/858001","http://flock.com/security/","http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html","http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","http://secunia.com/advisories/43068","http://src.chromium.org/viewvc/chrome?view=rev&revision=41244","http://www.vupen.com/english/advisories/2011/0212","https://bugs.webkit.org/show_bug.cgi?id=35948","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14067"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-1236","description":"The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \\x00javascript:alert sequence."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66040","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66040","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66040","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66040","date":"2026-10-19","epss":0.00776,"percentile":0.55015}],"risk":0.6311466666666667,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66040","description":"FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64834","versionConstraint":">= 0.6.3, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-19","epss":0.00727,"percentile":0.53305}],"risk":0.56706,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67215","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-10-19","epss":0.007,"percentile":0.52292}],"risk":0.546,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64830","versionConstraint":">= 2.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-19","epss":0.00646,"percentile":0.49996}],"risk":0.524875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.2&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-3262","versionConstraint":"<= 3.0.0.3989 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-3262","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-3262","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-3262","date":"2026-10-19","epss":0.01033,"percentile":0.63231}],"risk":0.48034499999999997,"urls":["http://flock.com/security/","http://www.securityfocus.com/archive/1/513701/100/0/threaded","http://www.securityfocus.com/bid/43225","https://exchange.xforce.ibmcloud.com/vulnerabilities/61820"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-3262","description":"Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67216","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-10-19","epss":0.00645,"percentile":0.49977}],"risk":0.474075,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."},"relatedVulnerabilities":[]},{"artifact":{"id":"9b4045387a59dbab","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24.2&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"risk":0.43371,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-19","epss":0.00549,"percentile":0.44829}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64835","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-19","epss":0.00496,"percentile":0.41261}],"risk":0.40299999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66041","versionConstraint":">= 7.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66041","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66041","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66041","date":"2026-10-19","epss":0.00487,"percentile":0.40662}],"risk":0.37986000000000003,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66041","description":"FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"3bfc5b995b5339c1","cpes":["cpe:2.3:a:pixman:pixman:0.46.4-r0:*:*:*:*:*:*:*"],"name":"pixman","purl":"pkg:apk/alpine/pixman@0.46.4-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"0.46.4-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpixman-1.so.0"},{"path":"/usr/lib/libpixman-1.so.0.46.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pixman"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pixman:pixman:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pixman:pixman:0.46.4:*:*:*:*:*:*:*"],"package":{"name":"pixman","version":"0.46.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-19","epss":0.00586,"percentile":0.46993}],"risk":0.33694999999999997,"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107695","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-19","epss":0.00457,"percentile":0.38313}],"risk":0.326755,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66036","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-19","epss":0.00401,"percentile":0.32865}],"risk":0.31946333333333327,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64833","versionConstraint":">= 0.7.1, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-19","epss":0.00396,"percentile":0.32304}],"risk":0.28908,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"eb222fe89d397776","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1.3.2-r1"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.3.2-r1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-19","epss":0.00356,"percentile":0.27804}],"risk":0.28124,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-19","epss":0.00356,"percentile":0.27804}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"1a2dcaebb90617d0","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r0:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r0?arch=x86_64&distro=alpine-3.24.2&upstream=cups","type":"apk","version":"2.4.19-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:cups:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-6553","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:cups:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-6553","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-6553","date":"2026-10-19","epss":0.00385,"percentile":0.31044}],"risk":0.27335,"urls":["https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html","https://security.gentoo.org/glsa/201908-08","https://usn.ubuntu.com/usn/usn-3713-1","https://www.debian.org/security/2018/dsa-4243"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6553","description":"The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-64832","versionConstraint":">= 4.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-19","epss":0.00335,"percentile":0.25385}],"risk":0.27218749999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-19","epss":0.00352,"percentile":0.27373}],"risk":0.25168,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66039","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-19","epss":0.00307,"percentile":0.22087}],"risk":0.24457666666666666,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67217","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-10-19","epss":0.00433,"percentile":0.36209}],"risk":0.24031499999999997,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65703","versionConstraint":">= 2.7, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-19","epss":0.00292,"percentile":0.20407}],"risk":0.22849,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a72590dac15d3c6f","cpes":["cpe:2.3:a:libxrender:libxrender:0.9.12-r0:*:*:*:*:*:*:*"],"name":"libxrender","purl":"pkg:apk/alpine/libxrender@0.9.12-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"0.9.12-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libXrender.so.1"},{"path":"/usr/lib/libXrender.so.1.3.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxrender"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.9.13-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"< 0.9.13-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libxrender","version":"0.9.12-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"0.9.13-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"< 0.9.13-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libxrender","version":"0.9.12-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"fixed","versions":["0.9.13-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"0.9.13-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-19","epss":0.0026,"percentile":0.16628}],"risk":0.21320000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88807"},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-19","epss":0.0026,"percentile":0.16628}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-16554","versionConstraint":"= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-10-19","epss":0.00291,"percentile":0.20386}],"risk":0.2029725,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-19","epss":0.00428,"percentile":0.35696}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-19","epss":0.00428,"percentile":0.35696}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-19","epss":0.00428,"percentile":0.35696}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-19","epss":0.00428,"percentile":0.35696}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66037","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66037","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66037","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66037","date":"2026-10-19","epss":0.00349,"percentile":0.27054}],"risk":0.19834833333333335,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627","https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66037","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing."},"relatedVulnerabilities":[]},{"artifact":{"id":"9b4045387a59dbab","cpes":["cpe:2.3:a:libexpat:libexpat:2.8.5-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=alpine-3.24.2&upstream=expat","type":"apk","version":"2.8.5-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.12.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"< 2.9.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"expat","version":"2.8.5-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"fixed","versions":["2.9.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"2.9.0-r0"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-19","epss":0.00348,"percentile":0.26964}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-19","epss":0.00348,"percentile":0.26964}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"5702a5a741fd2780","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.07.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:artifex:ghostscript:10.07.1-r0:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:apk/alpine/ghostscript@10.07.1-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"10.07.1-r0","language":"","licenses":["AGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/dvipdf"},{"path":"/usr/bin/eps2eps"},{"path":"/usr/bin/gs"},{"path":"/usr/bin/gsbj"},{"path":"/usr/bin/gsc"},{"path":"/usr/bin/gsdj"},{"path":"/usr/bin/gsdj500"},{"path":"/usr/bin/gslj"},{"path":"/usr/bin/gslp"},{"path":"/usr/bin/gsnd"},{"path":"/usr/bin/ijs_client_example"},{"path":"/usr/bin/ijs_server_example"},{"path":"/usr/bin/lprsetup.sh"},{"path":"/usr/bin/pdf2dsc"},{"path":"/usr/bin/pdf2ps"},{"path":"/usr/bin/pf2afm"},{"path":"/usr/bin/pfbtopfa"},{"path":"/usr/bin/pphs"},{"path":"/usr/bin/printafm"},{"path":"/usr/bin/ps2ascii"},{"path":"/usr/bin/ps2epsi"},{"path":"/usr/bin/ps2pdf"},{"path":"/usr/bin/ps2pdf12"},{"path":"/usr/bin/ps2pdf13"},{"path":"/usr/bin/ps2pdf14"},{"path":"/usr/bin/ps2pdfwr"},{"path":"/usr/bin/ps2ps"},{"path":"/usr/bin/ps2ps2"},{"path":"/usr/bin/unix-lpr.sh"},{"path":"/usr/lib"},{"path":"/usr/lib/libgs.so.10"},{"path":"/usr/lib/libgs.so.10.07"},{"path":"/usr/lib/libijs-0.35.so"},{"path":"/usr/share"},{"path":"/usr/share/fonts"},{"path":"/usr/share/fonts/Type1"},{"path":"/usr/share/ghostscript"},{"path":"/usr/share/ghostscript/Resource"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst/DroidSansFallback.ttf"},{"path":"/usr/share/ghostscript/Resource/CIDFont"},{"path":"/usr/share/ghostscript/Resource/CIDFont/ArtifexBullet"},{"path":"/usr/share/ghostscript/Resource/CMap"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/83pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-7"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan2-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hankaku"},{"path":"/usr/share/ghostscript/Resource/CMap/Hiragana"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Katakana"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-H"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-V"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Roman"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/V"},{"path":"/usr/share/ghostscript/Resource/CMap/WP-Symbol"},{"path":"/usr/share/ghostscript/Resource/ColorSpace"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultRGB"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/TrivialCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sRGB"},{"path":"/usr/share/ghostscript/Resource/Decoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Dingbats"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Symbol"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Unicode"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Wingdings"},{"path":"/usr/share/ghostscript/Resource/Decoding/Latin1"},{"path":"/usr/share/ghostscript/Resource/Decoding/StandardEncoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/Unicode"},{"path":"/usr/share/ghostscript/Resource/Encoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/CEEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertSubsetEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/NotDefEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/Wingdings"},{"path":"/usr/share/ghostscript/Resource/Font"},{"path":"/usr/share/ghostscript/Resource/Font/C059-BdIta"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/D050000L"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-BoldOblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Oblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/P052-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/StandardSymbolsPS"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-DemiItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Light"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-LightItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Book"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-BookOblique"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-DemiOblique"},{"path":"/usr/share/ghostscript/Resource/Font/Z003-MediumItalic"},{"path":"/usr/share/ghostscript/Resource/IdiomSet"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/PPI_CUtils"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/Pscript5Idiom"},{"path":"/usr/share/ghostscript/Resource/Init"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIcidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIconfig"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIfontmap"},{"path":"/usr/share/ghostscript/Resource/Init/FCOfontmap-PCLPS2"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap.GS"},{"path":"/usr/share/ghostscript/Resource/Init/cidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/gs_agl.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_btokn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cet.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cff.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidcm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ciddc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidtt.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cmap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cspace.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dbt_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_diskn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dscp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_epsf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fapi.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fntem.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fonts.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_frsd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_icc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_il1_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_img.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_init.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_lev2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ll3.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mex_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mgl_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mro_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdf_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdfwr.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_res.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_resmp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_setpd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_statd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_std_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_sym_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_trap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ttf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ32.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ42.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_type1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_wan_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/pdf_main.ps"},{"path":"/usr/share/ghostscript/Resource/Init/xlatmap"},{"path":"/usr/share/ghostscript/Resource/SubstCID"},{"path":"/usr/share/ghostscript/Resource/SubstCID/CNS1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/GB1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Japan1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Korea1-WMode"},{"path":"/usr/share/ghostscript/iccprofiles"},{"path":"/usr/share/ghostscript/iccprofiles/a98.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/esrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/gray_to_k.icc"},{"path":"/usr/share/ghostscript/iccprofiles/lab.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/rommrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/scrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/sgray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/srgb.icc"},{"path":"/usr/share/ghostscript/lib"},{"path":"/usr/share/ghostscript/lib/PDFA_def.ps"},{"path":"/usr/share/ghostscript/lib/PDFX_def.ps"},{"path":"/usr/share/ghostscript/lib/PM760p.upp"},{"path":"/usr/share/ghostscript/lib/PM760pl.upp"},{"path":"/usr/share/ghostscript/lib/PM820p.upp"},{"path":"/usr/share/ghostscript/lib/PM820pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc670p.upp"},{"path":"/usr/share/ghostscript/lib/Stc670pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc680p.upp"},{"path":"/usr/share/ghostscript/lib/Stc680pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc740p.upp"},{"path":"/usr/share/ghostscript/lib/Stc740pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc760p.upp"},{"path":"/usr/share/ghostscript/lib/Stc760pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc777p.upp"},{"path":"/usr/share/ghostscript/lib/Stc777pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp720p.upp"},{"path":"/usr/share/ghostscript/lib/Stp720pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp870p.upp"},{"path":"/usr/share/ghostscript/lib/Stp870pl.upp"},{"path":"/usr/share/ghostscript/lib/acctest.ps"},{"path":"/usr/share/ghostscript/lib/align.ps"},{"path":"/usr/share/ghostscript/lib/bj8.rpd"},{"path":"/usr/share/ghostscript/lib/bj8gc12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8hg12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8oh06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pa06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pp12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8ts06n.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a0.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a5.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a8.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b8.upp"},{"path":"/usr/share/ghostscript/lib/caption.ps"},{"path":"/usr/share/ghostscript/lib/cbjc600.ppd"},{"path":"/usr/share/ghostscript/lib/cbjc800.ppd"},{"path":"/usr/share/ghostscript/lib/cdj550.upp"},{"path":"/usr/share/ghostscript/lib/cdj690.upp"},{"path":"/usr/share/ghostscript/lib/cdj690ec.upp"},{"path":"/usr/share/ghostscript/lib/cid2code.ps"},{"path":"/usr/share/ghostscript/lib/dnj750c.upp"},{"path":"/usr/share/ghostscript/lib/dnj750m.upp"},{"path":"/usr/share/ghostscript/lib/docie.ps"},{"path":"/usr/share/ghostscript/lib/font2pcl.ps"},{"path":"/usr/share/ghostscript/lib/ghostpdf.ppd"},{"path":"/usr/share/ghostscript/lib/gs_ce_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_css_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_il2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_kanji.ps"},{"path":"/usr/share/ghostscript/lib/gs_ksb_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_l.xbm"},{"path":"/usr/share/ghostscript/lib/gs_l.xpm"},{"path":"/usr/share/ghostscript/lib/gs_l_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_lgo_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_lgx_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_m.xpm"},{"path":"/usr/share/ghostscript/lib/gs_m_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xpm"},{"path":"/usr/share/ghostscript/lib/gs_s_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xpm"},{"path":"/usr/share/ghostscript/lib/gs_t_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_wl1_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl5_e.ps"},{"path":"/usr/share/ghostscript/lib/gslp.ps"},{"path":"/usr/share/ghostscript/lib/gsnup.ps"},{"path":"/usr/share/ghostscript/lib/ht_ccsto.ps"},{"path":"/usr/share/ghostscript/lib/image-qa.ps"},{"path":"/usr/share/ghostscript/lib/jispaper.ps"},{"path":"/usr/share/ghostscript/lib/landscap.ps"},{"path":"/usr/share/ghostscript/lib/lines.ps"},{"path":"/usr/share/ghostscript/lib/mkcidfm.ps"},{"path":"/usr/share/ghostscript/lib/necp2x.upp"},{"path":"/usr/share/ghostscript/lib/necp2x6.upp"},{"path":"/usr/share/ghostscript/lib/pdf2dsc.ps"},{"path":"/usr/share/ghostscript/lib/pdf_info.ps"},{"path":"/usr/share/ghostscript/lib/pf2afm.ps"},{"path":"/usr/share/ghostscript/lib/pfbtopfa.ps"},{"path":"/usr/share/ghostscript/lib/ppath.ps"},{"path":"/usr/share/ghostscript/lib/pphs.ps"},{"path":"/usr/share/ghostscript/lib/prfont.ps"},{"path":"/usr/share/ghostscript/lib/printafm.ps"},{"path":"/usr/share/ghostscript/lib/ps2ai.ps"},{"path":"/usr/share/ghostscript/lib/ps2epsi.ps"},{"path":"/usr/share/ghostscript/lib/ras1.upp"},{"path":"/usr/share/ghostscript/lib/ras24.upp"},{"path":"/usr/share/ghostscript/lib/ras3.upp"},{"path":"/usr/share/ghostscript/lib/ras32.upp"},{"path":"/usr/share/ghostscript/lib/ras4.upp"},{"path":"/usr/share/ghostscript/lib/ras8m.upp"},{"path":"/usr/share/ghostscript/lib/rollconv.ps"},{"path":"/usr/share/ghostscript/lib/s400a1.upp"},{"path":"/usr/share/ghostscript/lib/s400b1.upp"},{"path":"/usr/share/ghostscript/lib/sharp.upp"},{"path":"/usr/share/ghostscript/lib/sipixa6.upp"},{"path":"/usr/share/ghostscript/lib/st640ih.upp"},{"path":"/usr/share/ghostscript/lib/st640ihg.upp"},{"path":"/usr/share/ghostscript/lib/st640p.upp"},{"path":"/usr/share/ghostscript/lib/st640pg.upp"},{"path":"/usr/share/ghostscript/lib/st640pl.upp"},{"path":"/usr/share/ghostscript/lib/st640plg.upp"},{"path":"/usr/share/ghostscript/lib/stc.upp"},{"path":"/usr/share/ghostscript/lib/stc1520h.upp"},{"path":"/usr/share/ghostscript/lib/stc2.upp"},{"path":"/usr/share/ghostscript/lib/stc200_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2s_h.upp"},{"path":"/usr/share/ghostscript/lib/stc300.upp"},{"path":"/usr/share/ghostscript/lib/stc300bl.upp"},{"path":"/usr/share/ghostscript/lib/stc300bm.upp"},{"path":"/usr/share/ghostscript/lib/stc500p.upp"},{"path":"/usr/share/ghostscript/lib/stc500ph.upp"},{"path":"/usr/share/ghostscript/lib/stc600ih.upp"},{"path":"/usr/share/ghostscript/lib/stc600p.upp"},{"path":"/usr/share/ghostscript/lib/stc600pl.upp"},{"path":"/usr/share/ghostscript/lib/stc640p.upp"},{"path":"/usr/share/ghostscript/lib/stc740ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800p.upp"},{"path":"/usr/share/ghostscript/lib/stc800pl.upp"},{"path":"/usr/share/ghostscript/lib/stc_h.upp"},{"path":"/usr/share/ghostscript/lib/stc_l.upp"},{"path":"/usr/share/ghostscript/lib/stcany.upp"},{"path":"/usr/share/ghostscript/lib/stcany_h.upp"},{"path":"/usr/share/ghostscript/lib/stcinfo.ps"},{"path":"/usr/share/ghostscript/lib/stcolor.ps"},{"path":"/usr/share/ghostscript/lib/stocht.ps"},{"path":"/usr/share/ghostscript/lib/traceimg.ps"},{"path":"/usr/share/ghostscript/lib/traceop.ps"},{"path":"/usr/share/ghostscript/lib/uninfo.ps"},{"path":"/usr/share/ghostscript/lib/viewcmyk.ps"},{"path":"/usr/share/ghostscript/lib/viewgif.ps"},{"path":"/usr/share/ghostscript/lib/viewjpeg.ps"},{"path":"/usr/share/ghostscript/lib/viewmiff.ps"},{"path":"/usr/share/ghostscript/lib/viewpbm.ps"},{"path":"/usr/share/ghostscript/lib/viewpcx.ps"},{"path":"/usr/share/ghostscript/lib/viewps2a.ps"},{"path":"/usr/share/ghostscript/lib/winmaps.ps"},{"path":"/usr/share/ghostscript/lib/zeroline.ps"},{"path":"/usr/share/ghostscript/lib/zugferd.ps"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ghostscript"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-38560","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:artifex:ghostscript:10.07.1:*:*:*:*:*:*:*"],"package":{"name":"ghostscript","version":"10.07.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-38560","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-38560","date":"2026-10-19","epss":0.00323,"percentile":0.23902}],"risk":0.169575,"urls":["https://access.redhat.com/security/cve/CVE-2023-38560","https://bugs.ghostscript.com/show_bug.cgi?id=706898","https://bugzilla.redhat.com/show_bug.cgi?id=2224368","https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107697","versionConstraint":"< 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-19","epss":0.00324,"percentile":0.23962}],"risk":0.15876,"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-10-19","epss":0.00202,"percentile":0.09534}],"risk":0.158065,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"23b1b1d87f1363da","cpes":["cpe:2.3:a:nginx:nginx:1.30.4-r1:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/alpine/nginx@1.30.4-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.30.4-r1","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90439","versionConstraint":">= 1.29.2, < 1.30.0||>= 1.30.4, < 1.30.5||>= 1.31.0, < 1.31.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.30.4:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.30.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90439","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90439","cwe":"CWE-122","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-90439","date":"2026-10-19","epss":0.00256,"percentile":0.16225}],"risk":0.14976,"urls":["https://my.f5.com/manage/s/article/K000162604"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90439","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1930d774020156","cpes":["cpe:2.3:a:libx11:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx:1.8.13-r0:*:*:*:*:*:*:*"],"name":"libx11","purl":"pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.8.13-r0","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libX11-xcb.so.1"},{"path":"/usr/lib/libX11-xcb.so.1.0.0"},{"path":"/usr/lib/libX11.so.6"},{"path":"/usr/lib/libX11.so.6.4.0"},{"path":"/usr/share"},{"path":"/usr/share/X11"},{"path":"/usr/share/X11/XErrorDB"},{"path":"/usr/share/X11/Xcms.txt"},{"path":"/usr/share/X11/locale"},{"path":"/usr/share/X11/locale/compose.dir"},{"path":"/usr/share/X11/locale/locale.alias"},{"path":"/usr/share/X11/locale/locale.dir"},{"path":"/usr/share/X11/locale/C"},{"path":"/usr/share/X11/locale/C/Compose"},{"path":"/usr/share/X11/locale/C/XI18N_OBJS"},{"path":"/usr/share/X11/locale/C/XLC_LOCALE"},{"path":"/usr/share/X11/locale/am_ET.UTF-8"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/Compose"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/armscii-8"},{"path":"/usr/share/X11/locale/armscii-8/Compose"},{"path":"/usr/share/X11/locale/armscii-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/armscii-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/Compose"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/el_GR.UTF-8"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/en_US.UTF-8"},{"path":"/usr/share/X11/locale/en_US.UTF-8/Compose"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/Compose"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-academy"},{"path":"/usr/share/X11/locale/georgian-academy/Compose"},{"path":"/usr/share/X11/locale/georgian-academy/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-academy/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-ps"},{"path":"/usr/share/X11/locale/georgian-ps/Compose"},{"path":"/usr/share/X11/locale/georgian-ps/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-ps/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ibm-cp1133"},{"path":"/usr/share/X11/locale/ibm-cp1133/Compose"},{"path":"/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iscii-dev"},{"path":"/usr/share/X11/locale/iscii-dev/Compose"},{"path":"/usr/share/X11/locale/iscii-dev/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iscii-dev/XLC_LOCALE"},{"path":"/usr/share/X11/locale/isiri-3342"},{"path":"/usr/share/X11/locale/isiri-3342/Compose"},{"path":"/usr/share/X11/locale/isiri-3342/XI18N_OBJS"},{"path":"/usr/share/X11/locale/isiri-3342/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-1"},{"path":"/usr/share/X11/locale/iso8859-1/Compose"},{"path":"/usr/share/X11/locale/iso8859-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-10"},{"path":"/usr/share/X11/locale/iso8859-10/Compose"},{"path":"/usr/share/X11/locale/iso8859-10/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-10/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-11"},{"path":"/usr/share/X11/locale/iso8859-11/Compose"},{"path":"/usr/share/X11/locale/iso8859-11/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-11/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-13"},{"path":"/usr/share/X11/locale/iso8859-13/Compose"},{"path":"/usr/share/X11/locale/iso8859-13/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-13/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-14"},{"path":"/usr/share/X11/locale/iso8859-14/Compose"},{"path":"/usr/share/X11/locale/iso8859-14/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-14/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-15"},{"path":"/usr/share/X11/locale/iso8859-15/Compose"},{"path":"/usr/share/X11/locale/iso8859-15/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-15/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-2"},{"path":"/usr/share/X11/locale/iso8859-2/Compose"},{"path":"/usr/share/X11/locale/iso8859-2/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-2/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-3"},{"path":"/usr/share/X11/locale/iso8859-3/Compose"},{"path":"/usr/share/X11/locale/iso8859-3/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-3/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-4"},{"path":"/usr/share/X11/locale/iso8859-4/Compose"},{"path":"/usr/share/X11/locale/iso8859-4/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-4/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-5"},{"path":"/usr/share/X11/locale/iso8859-5/Compose"},{"path":"/usr/share/X11/locale/iso8859-5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-6"},{"path":"/usr/share/X11/locale/iso8859-6/Compose"},{"path":"/usr/share/X11/locale/iso8859-6/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-6/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-7"},{"path":"/usr/share/X11/locale/iso8859-7/Compose"},{"path":"/usr/share/X11/locale/iso8859-7/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-7/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-8"},{"path":"/usr/share/X11/locale/iso8859-8/Compose"},{"path":"/usr/share/X11/locale/iso8859-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9"},{"path":"/usr/share/X11/locale/iso8859-9/Compose"},{"path":"/usr/share/X11/locale/iso8859-9/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9e"},{"path":"/usr/share/X11/locale/iso8859-9e/Compose"},{"path":"/usr/share/X11/locale/iso8859-9e/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9e/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja"},{"path":"/usr/share/X11/locale/ja/Compose"},{"path":"/usr/share/X11/locale/ja/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.JIS"},{"path":"/usr/share/X11/locale/ja.JIS/Compose"},{"path":"/usr/share/X11/locale/ja.JIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.JIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.SJIS"},{"path":"/usr/share/X11/locale/ja.SJIS/Compose"},{"path":"/usr/share/X11/locale/ja.SJIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.SJIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/km_KH.UTF-8"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko"},{"path":"/usr/share/X11/locale/ko/Compose"},{"path":"/usr/share/X11/locale/ko/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-c"},{"path":"/usr/share/X11/locale/koi8-c/Compose"},{"path":"/usr/share/X11/locale/koi8-c/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-c/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-r"},{"path":"/usr/share/X11/locale/koi8-r/Compose"},{"path":"/usr/share/X11/locale/koi8-r/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-r/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-u"},{"path":"/usr/share/X11/locale/koi8-u/Compose"},{"path":"/usr/share/X11/locale/koi8-u/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-u/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1251"},{"path":"/usr/share/X11/locale/microsoft-cp1251/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1255"},{"path":"/usr/share/X11/locale/microsoft-cp1255/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1256"},{"path":"/usr/share/X11/locale/microsoft-cp1256/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE"},{"path":"/usr/share/X11/locale/mulelao-1"},{"path":"/usr/share/X11/locale/mulelao-1/Compose"},{"path":"/usr/share/X11/locale/mulelao-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/mulelao-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/nokhchi-1"},{"path":"/usr/share/X11/locale/nokhchi-1/Compose"},{"path":"/usr/share/X11/locale/nokhchi-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/nokhchi-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/Compose"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tatar-cyr"},{"path":"/usr/share/X11/locale/tatar-cyr/Compose"},{"path":"/usr/share/X11/locale/tatar-cyr/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tatar-cyr/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH"},{"path":"/usr/share/X11/locale/th_TH/Compose"},{"path":"/usr/share/X11/locale/th_TH/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH.UTF-8"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tscii-0"},{"path":"/usr/share/X11/locale/tscii-0/Compose"},{"path":"/usr/share/X11/locale/tscii-0/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tscii-0/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.tcvn"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/Compose"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.viscii"},{"path":"/usr/share/X11/locale/vi_VN.viscii/Compose"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN"},{"path":"/usr/share/X11/locale/zh_CN/Compose"},{"path":"/usr/share/X11/locale/zh_CN/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gb18030"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gbk"},{"path":"/usr/share/X11/locale/zh_CN.gbk/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5"},{"path":"/usr/share/X11/locale/zh_HK.big5/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW"},{"path":"/usr/share/X11/locale/zh_TW/Compose"},{"path":"/usr/share/X11/locale/zh_TW/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.big5"},{"path":"/usr/share/X11/locale/zh_TW.big5/Compose"},{"path":"/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libx11"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"fixed","versions":["1.8.14-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"1.8.14-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-19","epss":0.00199,"percentile":0.09146}],"risk":0.14925,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88806"},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-19","epss":0.00199,"percentile":0.09146}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65706","versionConstraint":">= 3.0, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65706","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65706","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65706","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65706","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1463275,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779","https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65706","description":"FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-66038","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-19","epss":0.00242,"percentile":0.14413}],"risk":0.14156999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65705","versionConstraint":">= 3.4, <= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65705","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65705","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65705","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65705","date":"2026-10-19","epss":0.00187,"percentile":0.07834}],"risk":0.1407175,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780","https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65705","description":"FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-65704","versionConstraint":"<= 8.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-65704","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65704","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-65704","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65704","date":"2026-10-19","epss":0.00178,"percentile":0.06982}],"risk":0.13394499999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65704","description":"FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1930d774020156","cpes":["cpe:2.3:a:libx11:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx:1.8.13-r0:*:*:*:*:*:*:*"],"name":"libx11","purl":"pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.8.13-r0","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libX11-xcb.so.1"},{"path":"/usr/lib/libX11-xcb.so.1.0.0"},{"path":"/usr/lib/libX11.so.6"},{"path":"/usr/lib/libX11.so.6.4.0"},{"path":"/usr/share"},{"path":"/usr/share/X11"},{"path":"/usr/share/X11/XErrorDB"},{"path":"/usr/share/X11/Xcms.txt"},{"path":"/usr/share/X11/locale"},{"path":"/usr/share/X11/locale/compose.dir"},{"path":"/usr/share/X11/locale/locale.alias"},{"path":"/usr/share/X11/locale/locale.dir"},{"path":"/usr/share/X11/locale/C"},{"path":"/usr/share/X11/locale/C/Compose"},{"path":"/usr/share/X11/locale/C/XI18N_OBJS"},{"path":"/usr/share/X11/locale/C/XLC_LOCALE"},{"path":"/usr/share/X11/locale/am_ET.UTF-8"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/Compose"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/armscii-8"},{"path":"/usr/share/X11/locale/armscii-8/Compose"},{"path":"/usr/share/X11/locale/armscii-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/armscii-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/Compose"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/el_GR.UTF-8"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/en_US.UTF-8"},{"path":"/usr/share/X11/locale/en_US.UTF-8/Compose"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/Compose"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-academy"},{"path":"/usr/share/X11/locale/georgian-academy/Compose"},{"path":"/usr/share/X11/locale/georgian-academy/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-academy/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-ps"},{"path":"/usr/share/X11/locale/georgian-ps/Compose"},{"path":"/usr/share/X11/locale/georgian-ps/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-ps/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ibm-cp1133"},{"path":"/usr/share/X11/locale/ibm-cp1133/Compose"},{"path":"/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iscii-dev"},{"path":"/usr/share/X11/locale/iscii-dev/Compose"},{"path":"/usr/share/X11/locale/iscii-dev/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iscii-dev/XLC_LOCALE"},{"path":"/usr/share/X11/locale/isiri-3342"},{"path":"/usr/share/X11/locale/isiri-3342/Compose"},{"path":"/usr/share/X11/locale/isiri-3342/XI18N_OBJS"},{"path":"/usr/share/X11/locale/isiri-3342/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-1"},{"path":"/usr/share/X11/locale/iso8859-1/Compose"},{"path":"/usr/share/X11/locale/iso8859-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-10"},{"path":"/usr/share/X11/locale/iso8859-10/Compose"},{"path":"/usr/share/X11/locale/iso8859-10/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-10/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-11"},{"path":"/usr/share/X11/locale/iso8859-11/Compose"},{"path":"/usr/share/X11/locale/iso8859-11/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-11/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-13"},{"path":"/usr/share/X11/locale/iso8859-13/Compose"},{"path":"/usr/share/X11/locale/iso8859-13/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-13/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-14"},{"path":"/usr/share/X11/locale/iso8859-14/Compose"},{"path":"/usr/share/X11/locale/iso8859-14/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-14/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-15"},{"path":"/usr/share/X11/locale/iso8859-15/Compose"},{"path":"/usr/share/X11/locale/iso8859-15/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-15/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-2"},{"path":"/usr/share/X11/locale/iso8859-2/Compose"},{"path":"/usr/share/X11/locale/iso8859-2/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-2/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-3"},{"path":"/usr/share/X11/locale/iso8859-3/Compose"},{"path":"/usr/share/X11/locale/iso8859-3/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-3/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-4"},{"path":"/usr/share/X11/locale/iso8859-4/Compose"},{"path":"/usr/share/X11/locale/iso8859-4/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-4/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-5"},{"path":"/usr/share/X11/locale/iso8859-5/Compose"},{"path":"/usr/share/X11/locale/iso8859-5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-6"},{"path":"/usr/share/X11/locale/iso8859-6/Compose"},{"path":"/usr/share/X11/locale/iso8859-6/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-6/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-7"},{"path":"/usr/share/X11/locale/iso8859-7/Compose"},{"path":"/usr/share/X11/locale/iso8859-7/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-7/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-8"},{"path":"/usr/share/X11/locale/iso8859-8/Compose"},{"path":"/usr/share/X11/locale/iso8859-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9"},{"path":"/usr/share/X11/locale/iso8859-9/Compose"},{"path":"/usr/share/X11/locale/iso8859-9/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9e"},{"path":"/usr/share/X11/locale/iso8859-9e/Compose"},{"path":"/usr/share/X11/locale/iso8859-9e/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9e/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja"},{"path":"/usr/share/X11/locale/ja/Compose"},{"path":"/usr/share/X11/locale/ja/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.JIS"},{"path":"/usr/share/X11/locale/ja.JIS/Compose"},{"path":"/usr/share/X11/locale/ja.JIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.JIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.SJIS"},{"path":"/usr/share/X11/locale/ja.SJIS/Compose"},{"path":"/usr/share/X11/locale/ja.SJIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.SJIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/km_KH.UTF-8"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko"},{"path":"/usr/share/X11/locale/ko/Compose"},{"path":"/usr/share/X11/locale/ko/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-c"},{"path":"/usr/share/X11/locale/koi8-c/Compose"},{"path":"/usr/share/X11/locale/koi8-c/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-c/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-r"},{"path":"/usr/share/X11/locale/koi8-r/Compose"},{"path":"/usr/share/X11/locale/koi8-r/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-r/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-u"},{"path":"/usr/share/X11/locale/koi8-u/Compose"},{"path":"/usr/share/X11/locale/koi8-u/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-u/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1251"},{"path":"/usr/share/X11/locale/microsoft-cp1251/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1255"},{"path":"/usr/share/X11/locale/microsoft-cp1255/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1256"},{"path":"/usr/share/X11/locale/microsoft-cp1256/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE"},{"path":"/usr/share/X11/locale/mulelao-1"},{"path":"/usr/share/X11/locale/mulelao-1/Compose"},{"path":"/usr/share/X11/locale/mulelao-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/mulelao-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/nokhchi-1"},{"path":"/usr/share/X11/locale/nokhchi-1/Compose"},{"path":"/usr/share/X11/locale/nokhchi-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/nokhchi-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/Compose"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tatar-cyr"},{"path":"/usr/share/X11/locale/tatar-cyr/Compose"},{"path":"/usr/share/X11/locale/tatar-cyr/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tatar-cyr/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH"},{"path":"/usr/share/X11/locale/th_TH/Compose"},{"path":"/usr/share/X11/locale/th_TH/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH.UTF-8"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tscii-0"},{"path":"/usr/share/X11/locale/tscii-0/Compose"},{"path":"/usr/share/X11/locale/tscii-0/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tscii-0/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.tcvn"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/Compose"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.viscii"},{"path":"/usr/share/X11/locale/vi_VN.viscii/Compose"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN"},{"path":"/usr/share/X11/locale/zh_CN/Compose"},{"path":"/usr/share/X11/locale/zh_CN/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gb18030"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gbk"},{"path":"/usr/share/X11/locale/zh_CN.gbk/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5"},{"path":"/usr/share/X11/locale/zh_HK.big5/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW"},{"path":"/usr/share/X11/locale/zh_TW/Compose"},{"path":"/usr/share/X11/locale/zh_TW/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.big5"},{"path":"/usr/share/X11/locale/zh_TW.big5/Compose"},{"path":"/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libx11"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"fixed","versions":["1.8.14-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"1.8.14-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-19","epss":0.00199,"percentile":0.09124}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94283"},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-19","epss":0.00199,"percentile":0.09124}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-10-19","epss":0.00145,"percentile":0.03383}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"7f29870008af73d5","cpes":["cpe:2.3:a:sudo:sudo:1.9.17_p2-r1:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:apk/alpine/sudo@1.9.17_p2-r1?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.9.17_p2-r1","language":"","licenses":["ISC","custom"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/sudo.conf"},{"path":"/etc/sudo_logsrvd.conf"},{"path":"/etc/sudoers"},{"path":"/etc/sudoers.d"},{"path":"/run"},{"path":"/run/sudo"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/cvtsudoers"},{"path":"/usr/bin/sudo"},{"path":"/usr/bin/sudoedit"},{"path":"/usr/bin/sudoreplay"},{"path":"/usr/lib"},{"path":"/usr/lib/sudo"},{"path":"/usr/lib/sudo/audit_json.so"},{"path":"/usr/lib/sudo/group_file.so"},{"path":"/usr/lib/sudo/libsudo_util.so"},{"path":"/usr/lib/sudo/libsudo_util.so.0"},{"path":"/usr/lib/sudo/libsudo_util.so.0.0.0"},{"path":"/usr/lib/sudo/sudo_intercept.so"},{"path":"/usr/lib/sudo/sudo_noexec.so"},{"path":"/usr/lib/sudo/sudoers.so"},{"path":"/usr/lib/sudo/system_group.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/sudo_logsrvd"},{"path":"/usr/sbin/sudo_sendlog"},{"path":"/usr/sbin/visudo"},{"path":"/var"},{"path":"/var/db"},{"path":"/var/lib"},{"path":"/var/lib/sudo"},{"path":"/var/lib/sudo/lectured"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sudo"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.9.17_p2-r2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-96512","versionConstraint":"< 1.9.17_p2-r2 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"sudo","version":"1.9.17_p2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.9.17_p2-r2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-96512","versionConstraint":"< 1.9.17_p2-r2 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"sudo","version":"1.9.17_p2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-96512","fix":{"state":"fixed","versions":["1.9.17_p2-r2"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"1.9.17_p2-r2"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96512","cwe":"CWE-863","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-96512","date":"2026-10-19","epss":0.00138,"percentile":0.02882}],"risk":0.10557,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-96512"},"relatedVulnerabilities":[{"id":"CVE-2026-96512","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96512","cwe":"CWE-863","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-96512","date":"2026-10-19","epss":0.00138,"percentile":0.02882}],"urls":["https://access.redhat.com/errata/RHSA-2026:71609","https://access.redhat.com/errata/RHSA-2026:75571","https://access.redhat.com/errata/RHSA-2026:75579","https://access.redhat.com/errata/RHSA-2026:75580","https://access.redhat.com/errata/RHSA-2026:82939","https://access.redhat.com/security/cve/CVE-2026-96512","https://bugzilla.redhat.com/show_bug.cgi?id=2539327","https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c","http://www.openwall.com/lists/oss-security/2026/09/24/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96512","description":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected."}]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-10-19","epss":0.00188,"percentile":0.07933}],"risk":0.10293,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-19","epss":0.00138,"percentile":0.0287}],"risk":0.09935999999999999,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-10-19","epss":0.00178,"percentile":0.06926}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52296","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52296","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52296","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52296","date":"2026-10-19","epss":0.00158,"percentile":0.04508}],"risk":0.09875,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296","description":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-10-19","epss":0.00175,"percentile":0.0657}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"4e1790a514166e85","cpes":["cpe:2.3:a:libarchive:libarchive:3.8.7-r0:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:apk/alpine/libarchive@3.8.7-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"3.8.7-r0","language":"","licenses":["AND","BSD-2-Clause","BSD-3-Clause","Public-Domain"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libarchive.so.13"},{"path":"/usr/lib/libarchive.so.13.8.7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libarchive"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5745","versionConstraint":"<= 3.8.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:libarchive:libarchive:3.8.7:*:*:*:*:*:*:*"],"package":{"name":"libarchive","version":"3.8.7-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5745","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5745","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5745","date":"2026-10-19","epss":0.00171,"percentile":0.06132}],"risk":0.089775,"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-5745","https://bugzilla.redhat.com/show_bug.cgi?id=2455921"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","description":"A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-19","epss":0.00171,"percentile":0.0607}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-10-19","epss":0.00176,"percentile":0.06703}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-19","epss":0.00186,"percentile":0.07735}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-19","epss":0.00186,"percentile":0.07735}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-19","epss":0.00186,"percentile":0.07735}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-19","epss":0.00186,"percentile":0.07735}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-19","epss":0.0017,"percentile":0.06023}],"risk":0.08159999999999999,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-10-19","epss":0.00108,"percentile":0.01122}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52297","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52297","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52297","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-52297","date":"2026-10-19","epss":0.00116,"percentile":0.01492}],"risk":0.0725,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297","description":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107660","versionConstraint":"< 8.1.3||>= 9.0, < 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107660","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107660","cwe":"CWE-297","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107660","date":"2026-10-19","epss":0.00136,"percentile":0.02705}],"risk":0.07174,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavformat/tls_mbedtls.c#L676-L681","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-mbedtls-hostname-verification-bypass-for-ip-hosts"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-10-19","epss":0.00139,"percentile":0.02924}],"risk":0.07089,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-10-19","epss":0.00144,"percentile":0.03313}],"risk":0.06516,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1930d774020156","cpes":["cpe:2.3:a:libx11:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx:1.8.13-r0:*:*:*:*:*:*:*"],"name":"libx11","purl":"pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.8.13-r0","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libX11-xcb.so.1"},{"path":"/usr/lib/libX11-xcb.so.1.0.0"},{"path":"/usr/lib/libX11.so.6"},{"path":"/usr/lib/libX11.so.6.4.0"},{"path":"/usr/share"},{"path":"/usr/share/X11"},{"path":"/usr/share/X11/XErrorDB"},{"path":"/usr/share/X11/Xcms.txt"},{"path":"/usr/share/X11/locale"},{"path":"/usr/share/X11/locale/compose.dir"},{"path":"/usr/share/X11/locale/locale.alias"},{"path":"/usr/share/X11/locale/locale.dir"},{"path":"/usr/share/X11/locale/C"},{"path":"/usr/share/X11/locale/C/Compose"},{"path":"/usr/share/X11/locale/C/XI18N_OBJS"},{"path":"/usr/share/X11/locale/C/XLC_LOCALE"},{"path":"/usr/share/X11/locale/am_ET.UTF-8"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/Compose"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/armscii-8"},{"path":"/usr/share/X11/locale/armscii-8/Compose"},{"path":"/usr/share/X11/locale/armscii-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/armscii-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/Compose"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/el_GR.UTF-8"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/en_US.UTF-8"},{"path":"/usr/share/X11/locale/en_US.UTF-8/Compose"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/Compose"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-academy"},{"path":"/usr/share/X11/locale/georgian-academy/Compose"},{"path":"/usr/share/X11/locale/georgian-academy/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-academy/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-ps"},{"path":"/usr/share/X11/locale/georgian-ps/Compose"},{"path":"/usr/share/X11/locale/georgian-ps/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-ps/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ibm-cp1133"},{"path":"/usr/share/X11/locale/ibm-cp1133/Compose"},{"path":"/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iscii-dev"},{"path":"/usr/share/X11/locale/iscii-dev/Compose"},{"path":"/usr/share/X11/locale/iscii-dev/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iscii-dev/XLC_LOCALE"},{"path":"/usr/share/X11/locale/isiri-3342"},{"path":"/usr/share/X11/locale/isiri-3342/Compose"},{"path":"/usr/share/X11/locale/isiri-3342/XI18N_OBJS"},{"path":"/usr/share/X11/locale/isiri-3342/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-1"},{"path":"/usr/share/X11/locale/iso8859-1/Compose"},{"path":"/usr/share/X11/locale/iso8859-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-10"},{"path":"/usr/share/X11/locale/iso8859-10/Compose"},{"path":"/usr/share/X11/locale/iso8859-10/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-10/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-11"},{"path":"/usr/share/X11/locale/iso8859-11/Compose"},{"path":"/usr/share/X11/locale/iso8859-11/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-11/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-13"},{"path":"/usr/share/X11/locale/iso8859-13/Compose"},{"path":"/usr/share/X11/locale/iso8859-13/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-13/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-14"},{"path":"/usr/share/X11/locale/iso8859-14/Compose"},{"path":"/usr/share/X11/locale/iso8859-14/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-14/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-15"},{"path":"/usr/share/X11/locale/iso8859-15/Compose"},{"path":"/usr/share/X11/locale/iso8859-15/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-15/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-2"},{"path":"/usr/share/X11/locale/iso8859-2/Compose"},{"path":"/usr/share/X11/locale/iso8859-2/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-2/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-3"},{"path":"/usr/share/X11/locale/iso8859-3/Compose"},{"path":"/usr/share/X11/locale/iso8859-3/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-3/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-4"},{"path":"/usr/share/X11/locale/iso8859-4/Compose"},{"path":"/usr/share/X11/locale/iso8859-4/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-4/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-5"},{"path":"/usr/share/X11/locale/iso8859-5/Compose"},{"path":"/usr/share/X11/locale/iso8859-5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-6"},{"path":"/usr/share/X11/locale/iso8859-6/Compose"},{"path":"/usr/share/X11/locale/iso8859-6/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-6/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-7"},{"path":"/usr/share/X11/locale/iso8859-7/Compose"},{"path":"/usr/share/X11/locale/iso8859-7/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-7/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-8"},{"path":"/usr/share/X11/locale/iso8859-8/Compose"},{"path":"/usr/share/X11/locale/iso8859-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9"},{"path":"/usr/share/X11/locale/iso8859-9/Compose"},{"path":"/usr/share/X11/locale/iso8859-9/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9e"},{"path":"/usr/share/X11/locale/iso8859-9e/Compose"},{"path":"/usr/share/X11/locale/iso8859-9e/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9e/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja"},{"path":"/usr/share/X11/locale/ja/Compose"},{"path":"/usr/share/X11/locale/ja/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.JIS"},{"path":"/usr/share/X11/locale/ja.JIS/Compose"},{"path":"/usr/share/X11/locale/ja.JIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.JIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.SJIS"},{"path":"/usr/share/X11/locale/ja.SJIS/Compose"},{"path":"/usr/share/X11/locale/ja.SJIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.SJIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/km_KH.UTF-8"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko"},{"path":"/usr/share/X11/locale/ko/Compose"},{"path":"/usr/share/X11/locale/ko/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-c"},{"path":"/usr/share/X11/locale/koi8-c/Compose"},{"path":"/usr/share/X11/locale/koi8-c/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-c/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-r"},{"path":"/usr/share/X11/locale/koi8-r/Compose"},{"path":"/usr/share/X11/locale/koi8-r/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-r/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-u"},{"path":"/usr/share/X11/locale/koi8-u/Compose"},{"path":"/usr/share/X11/locale/koi8-u/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-u/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1251"},{"path":"/usr/share/X11/locale/microsoft-cp1251/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1255"},{"path":"/usr/share/X11/locale/microsoft-cp1255/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1256"},{"path":"/usr/share/X11/locale/microsoft-cp1256/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE"},{"path":"/usr/share/X11/locale/mulelao-1"},{"path":"/usr/share/X11/locale/mulelao-1/Compose"},{"path":"/usr/share/X11/locale/mulelao-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/mulelao-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/nokhchi-1"},{"path":"/usr/share/X11/locale/nokhchi-1/Compose"},{"path":"/usr/share/X11/locale/nokhchi-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/nokhchi-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/Compose"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tatar-cyr"},{"path":"/usr/share/X11/locale/tatar-cyr/Compose"},{"path":"/usr/share/X11/locale/tatar-cyr/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tatar-cyr/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH"},{"path":"/usr/share/X11/locale/th_TH/Compose"},{"path":"/usr/share/X11/locale/th_TH/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH.UTF-8"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tscii-0"},{"path":"/usr/share/X11/locale/tscii-0/Compose"},{"path":"/usr/share/X11/locale/tscii-0/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tscii-0/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.tcvn"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/Compose"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.viscii"},{"path":"/usr/share/X11/locale/vi_VN.viscii/Compose"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN"},{"path":"/usr/share/X11/locale/zh_CN/Compose"},{"path":"/usr/share/X11/locale/zh_CN/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gb18030"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gbk"},{"path":"/usr/share/X11/locale/zh_CN.gbk/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5"},{"path":"/usr/share/X11/locale/zh_HK.big5/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW"},{"path":"/usr/share/X11/locale/zh_TW/Compose"},{"path":"/usr/share/X11/locale/zh_TW/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.big5"},{"path":"/usr/share/X11/locale/zh_TW.big5/Compose"},{"path":"/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libx11"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94285","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94285","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94285","fix":{"state":"fixed","versions":["1.8.14-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"1.8.14-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-19","epss":0.00111,"percentile":0.01271}],"risk":0.05605500000000001,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94285"},"relatedVulnerabilities":[{"id":"CVE-2026-94285","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-19","epss":0.00111,"percentile":0.01271}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94285","description":"An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-19","epss":0.00115,"percentile":0.01448}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f1930d774020156","cpes":["cpe:2.3:a:libx11:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx11:1.8.13-r0:*:*:*:*:*:*:*","cpe:2.3:a:libx:libx:1.8.13-r0:*:*:*:*:*:*:*"],"name":"libx11","purl":"pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.8.13-r0","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libX11-xcb.so.1"},{"path":"/usr/lib/libX11-xcb.so.1.0.0"},{"path":"/usr/lib/libX11.so.6"},{"path":"/usr/lib/libX11.so.6.4.0"},{"path":"/usr/share"},{"path":"/usr/share/X11"},{"path":"/usr/share/X11/XErrorDB"},{"path":"/usr/share/X11/Xcms.txt"},{"path":"/usr/share/X11/locale"},{"path":"/usr/share/X11/locale/compose.dir"},{"path":"/usr/share/X11/locale/locale.alias"},{"path":"/usr/share/X11/locale/locale.dir"},{"path":"/usr/share/X11/locale/C"},{"path":"/usr/share/X11/locale/C/Compose"},{"path":"/usr/share/X11/locale/C/XI18N_OBJS"},{"path":"/usr/share/X11/locale/C/XLC_LOCALE"},{"path":"/usr/share/X11/locale/am_ET.UTF-8"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/Compose"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/armscii-8"},{"path":"/usr/share/X11/locale/armscii-8/Compose"},{"path":"/usr/share/X11/locale/armscii-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/armscii-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/Compose"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/el_GR.UTF-8"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/en_US.UTF-8"},{"path":"/usr/share/X11/locale/en_US.UTF-8/Compose"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/Compose"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-academy"},{"path":"/usr/share/X11/locale/georgian-academy/Compose"},{"path":"/usr/share/X11/locale/georgian-academy/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-academy/XLC_LOCALE"},{"path":"/usr/share/X11/locale/georgian-ps"},{"path":"/usr/share/X11/locale/georgian-ps/Compose"},{"path":"/usr/share/X11/locale/georgian-ps/XI18N_OBJS"},{"path":"/usr/share/X11/locale/georgian-ps/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ibm-cp1133"},{"path":"/usr/share/X11/locale/ibm-cp1133/Compose"},{"path":"/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iscii-dev"},{"path":"/usr/share/X11/locale/iscii-dev/Compose"},{"path":"/usr/share/X11/locale/iscii-dev/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iscii-dev/XLC_LOCALE"},{"path":"/usr/share/X11/locale/isiri-3342"},{"path":"/usr/share/X11/locale/isiri-3342/Compose"},{"path":"/usr/share/X11/locale/isiri-3342/XI18N_OBJS"},{"path":"/usr/share/X11/locale/isiri-3342/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-1"},{"path":"/usr/share/X11/locale/iso8859-1/Compose"},{"path":"/usr/share/X11/locale/iso8859-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-10"},{"path":"/usr/share/X11/locale/iso8859-10/Compose"},{"path":"/usr/share/X11/locale/iso8859-10/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-10/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-11"},{"path":"/usr/share/X11/locale/iso8859-11/Compose"},{"path":"/usr/share/X11/locale/iso8859-11/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-11/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-13"},{"path":"/usr/share/X11/locale/iso8859-13/Compose"},{"path":"/usr/share/X11/locale/iso8859-13/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-13/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-14"},{"path":"/usr/share/X11/locale/iso8859-14/Compose"},{"path":"/usr/share/X11/locale/iso8859-14/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-14/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-15"},{"path":"/usr/share/X11/locale/iso8859-15/Compose"},{"path":"/usr/share/X11/locale/iso8859-15/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-15/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-2"},{"path":"/usr/share/X11/locale/iso8859-2/Compose"},{"path":"/usr/share/X11/locale/iso8859-2/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-2/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-3"},{"path":"/usr/share/X11/locale/iso8859-3/Compose"},{"path":"/usr/share/X11/locale/iso8859-3/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-3/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-4"},{"path":"/usr/share/X11/locale/iso8859-4/Compose"},{"path":"/usr/share/X11/locale/iso8859-4/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-4/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-5"},{"path":"/usr/share/X11/locale/iso8859-5/Compose"},{"path":"/usr/share/X11/locale/iso8859-5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-6"},{"path":"/usr/share/X11/locale/iso8859-6/Compose"},{"path":"/usr/share/X11/locale/iso8859-6/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-6/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-7"},{"path":"/usr/share/X11/locale/iso8859-7/Compose"},{"path":"/usr/share/X11/locale/iso8859-7/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-7/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-8"},{"path":"/usr/share/X11/locale/iso8859-8/Compose"},{"path":"/usr/share/X11/locale/iso8859-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9"},{"path":"/usr/share/X11/locale/iso8859-9/Compose"},{"path":"/usr/share/X11/locale/iso8859-9/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9/XLC_LOCALE"},{"path":"/usr/share/X11/locale/iso8859-9e"},{"path":"/usr/share/X11/locale/iso8859-9e/Compose"},{"path":"/usr/share/X11/locale/iso8859-9e/XI18N_OBJS"},{"path":"/usr/share/X11/locale/iso8859-9e/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja"},{"path":"/usr/share/X11/locale/ja/Compose"},{"path":"/usr/share/X11/locale/ja/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.JIS"},{"path":"/usr/share/X11/locale/ja.JIS/Compose"},{"path":"/usr/share/X11/locale/ja.JIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.JIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja.SJIS"},{"path":"/usr/share/X11/locale/ja.SJIS/Compose"},{"path":"/usr/share/X11/locale/ja.SJIS/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja.SJIS/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/km_KH.UTF-8"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko"},{"path":"/usr/share/X11/locale/ko/Compose"},{"path":"/usr/share/X11/locale/ko/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-c"},{"path":"/usr/share/X11/locale/koi8-c/Compose"},{"path":"/usr/share/X11/locale/koi8-c/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-c/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-r"},{"path":"/usr/share/X11/locale/koi8-r/Compose"},{"path":"/usr/share/X11/locale/koi8-r/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-r/XLC_LOCALE"},{"path":"/usr/share/X11/locale/koi8-u"},{"path":"/usr/share/X11/locale/koi8-u/Compose"},{"path":"/usr/share/X11/locale/koi8-u/XI18N_OBJS"},{"path":"/usr/share/X11/locale/koi8-u/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1251"},{"path":"/usr/share/X11/locale/microsoft-cp1251/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1255"},{"path":"/usr/share/X11/locale/microsoft-cp1255/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE"},{"path":"/usr/share/X11/locale/microsoft-cp1256"},{"path":"/usr/share/X11/locale/microsoft-cp1256/Compose"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS"},{"path":"/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE"},{"path":"/usr/share/X11/locale/mulelao-1"},{"path":"/usr/share/X11/locale/mulelao-1/Compose"},{"path":"/usr/share/X11/locale/mulelao-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/mulelao-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/nokhchi-1"},{"path":"/usr/share/X11/locale/nokhchi-1/Compose"},{"path":"/usr/share/X11/locale/nokhchi-1/XI18N_OBJS"},{"path":"/usr/share/X11/locale/nokhchi-1/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/Compose"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/Compose"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/Compose"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tatar-cyr"},{"path":"/usr/share/X11/locale/tatar-cyr/Compose"},{"path":"/usr/share/X11/locale/tatar-cyr/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tatar-cyr/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH"},{"path":"/usr/share/X11/locale/th_TH/Compose"},{"path":"/usr/share/X11/locale/th_TH/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH/XLC_LOCALE"},{"path":"/usr/share/X11/locale/th_TH.UTF-8"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/Compose"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/tscii-0"},{"path":"/usr/share/X11/locale/tscii-0/Compose"},{"path":"/usr/share/X11/locale/tscii-0/XI18N_OBJS"},{"path":"/usr/share/X11/locale/tscii-0/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.tcvn"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/Compose"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE"},{"path":"/usr/share/X11/locale/vi_VN.viscii"},{"path":"/usr/share/X11/locale/vi_VN.viscii/Compose"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS"},{"path":"/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN"},{"path":"/usr/share/X11/locale/zh_CN/Compose"},{"path":"/usr/share/X11/locale/zh_CN/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gb18030"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_CN.gbk"},{"path":"/usr/share/X11/locale/zh_CN.gbk/Compose"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5"},{"path":"/usr/share/X11/locale/zh_HK.big5/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/Compose"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW"},{"path":"/usr/share/X11/locale/zh_TW/Compose"},{"path":"/usr/share/X11/locale/zh_TW/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/Compose"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE"},{"path":"/usr/share/X11/locale/zh_TW.big5"},{"path":"/usr/share/X11/locale/zh_TW.big5/Compose"},{"path":"/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS"},{"path":"/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libx11"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94284","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.8.14-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94284","versionConstraint":"< 1.8.14-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libx11","version":"1.8.13-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94284","fix":{"state":"fixed","versions":["1.8.14-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"1.8.14-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-19","epss":0.00103,"percentile":0.00931}],"risk":0.05407500000000001,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94284"},"relatedVulnerabilities":[{"id":"CVE-2026-94284","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-19","epss":0.00103,"percentile":0.00931}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94284","description":"An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"49b42b1d704efc5d","cpes":["cpe:2.3:a:libxpm-project:libxpm:3.5.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:libxpm_project:libxpm:3.5.19-r0:*:*:*:*:*:*:*","cpe:2.3:a:libxpm:libxpm:3.5.19-r0:*:*:*:*:*:*:*"],"name":"libxpm","purl":"pkg:apk/alpine/libxpm@3.5.19-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"3.5.19-r0","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/cxpm"},{"path":"/usr/bin/sxpm"},{"path":"/usr/lib"},{"path":"/usr/lib/libXpm.so.4"},{"path":"/usr/lib/libXpm.so.4.11.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxpm"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.20-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94287","versionConstraint":"< 3.5.20-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libxpm","version":"3.5.19-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"3.5.20-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94287","versionConstraint":"< 3.5.20-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"libxpm","version":"3.5.19-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94287","fix":{"state":"fixed","versions":["3.5.20-r0"],"available":[{"date":"2026-10-19","kind":"first-observed","version":"3.5.20-r0"}]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94287","cwe":"CWE-1050","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94287","date":"2026-10-19","epss":0.001,"percentile":0.00808}],"risk":0.052500000000000005,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94287"},"relatedVulnerabilities":[{"id":"CVE-2026-94287","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94287","cwe":"CWE-1050","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94287","date":"2026-10-19","epss":0.001,"percentile":0.00808}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32/diffs?commit_id=3a68f818b1628d7ad96245b0f4d15a32a015b0ab"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94287","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-19","epss":0.00111,"percentile":0.01232}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a981d172331533a","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd1d29bf30c1bae9","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"04fe0018c3427b0a","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"fcc2b46c35eb103c","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"4173cf2fc659ac9d","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c11220a4fbbc883","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3d12aa6031708d4","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"279cffe44500eb51","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.2-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.2-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.2-r0?arch=x86_64&distro=alpine-3.24.2&upstream=ffmpeg","type":"apk","version":"8.1.2-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.102"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.2:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-10-19","epss":0.00094,"percentile":0.00563}],"risk":0.047939999999999997,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"03d40e747f1d68fb","cpes":["cpe:2.3:a:files-pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files-pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"files_pdfviewer","purl":"pkg:npm/files_pdfviewer@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/files_pdfviewer/package.json","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/app/www/src/apps/files_pdfviewer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46fq-v4pg-gr3j","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"files_pdfviewer","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46fq-v4pg-gr3j","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46fq-v4pg-gr3j","description":"Malware in files_pdfviewer"},"relatedVulnerabilities":[]},{"artifact":{"id":"91680863d5c139d4","cpes":["cpe:2.3:a:firstrunwizard:firstrunwizard:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"firstrunwizard","purl":"pkg:npm/firstrunwizard@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/firstrunwizard/package.json","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/app/www/src/apps/firstrunwizard/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqc2-7f54-r7wp","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"firstrunwizard","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqc2-7f54-r7wp","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqc2-7f54-r7wp","description":"Malware in firstrunwizard"},"relatedVulnerabilities":[]},{"artifact":{"id":"cbd77e4fe96fe423","cpes":["cpe:2.3:a:rust-random:rand:0.9.1:*:*:*:*:rust:*:*"],"name":"rand","purl":"pkg:cargo/rand@0.9.1","type":"rust-crate","version":"0.9.1","language":"rust","licenses":[],"locations":[{"path":"/usr/lib/librav1e.so.0.8.1","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/usr/lib/librav1e.so.0.8.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cq8v-f236-94qc","versionConstraint":">=0.9.0,<0.9.3 (unknown)"},"matcher":"rust-matcher","searchedBy":{"package":{"name":"rand","version":"0.9.1"},"language":"rust","namespace":"github:language:rust"}}],"vulnerability":{"id":"GHSA-cq8v-f236-94qc","fix":{"state":"fixed","versions":["0.9.3"],"available":[{"date":"2026-04-14","kind":"first-observed","version":"0.9.3"}]},"cvss":[],"risk":0,"urls":["https://github.com/rust-random/rand/pull/1763","https://rustsec.org/advisories/RUSTSEC-2026-0097.html"],"severity":"Low","namespace":"github:language:rust","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cq8v-f236-94qc","description":"Rand is unsound with a custom logger using rand::rng()"},"relatedVulnerabilities":[]},{"artifact":{"id":"61eb258d7cce9ccb","cpes":["cpe:2.3:a:web-auth\\/webauthn-lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn-lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*"],"name":"web-auth/webauthn-lib","purl":"pkg:composer/web-auth/webauthn-lib@4.9.3","type":"php-composer","version":"4.9.3","language":"php","licenses":["MIT"],"locations":[{"path":"/app/www/src/3rdparty/composer/installed.json","layerID":"sha256:a252261e59d9c0a06dbd6a543cc256a0a40d050a0e9dac7c0da5ebb9a3268871","accessPath":"/app/www/src/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gq4g-fpc9-vjfq","versionConstraint":">=4.9.0,<5.3.5 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"web-auth/webauthn-lib","version":"4.9.3"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gq4g-fpc9-vjfq","fix":{"state":"fixed","versions":["5.3.5"],"available":[{"date":"2026-07-08","kind":"first-observed","version":"5.3.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gq4g-fpc9-vjfq","description":"Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-21T07:40:56.441Z","grype_db_version":"2026-10-20T06:29:49.000Z"}