CVE-2026-40962: Integer Overflow
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:8.1.2-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40962?
CVE-2026-40962 is classified as a high severity vulnerability due to its potential to cause an out-of-bounds write.
How do I fix CVE-2026-40962?
To mitigate CVE-2026-40962, upgrade FFmpeg to version 8.1 or later, where the vulnerability has been patched.
What is the impact of CVE-2026-40962 on affected systems?
CVE-2026-40962 can lead to potential code execution and system crashes via out-of-bounds writes when processing CENC subsample data.
Which versions of FFmpeg are affected by CVE-2026-40962?
FFmpeg versions prior to 8.1 are vulnerable to CVE-2026-40962.
How does CVE-2026-40962 exploit CENC data?
CVE-2026-40962 exploits an integer overflow in the handling of CENC subsample data, resulting in unsafe memory write operations.