CVE-2026-52296: Low severity FFmpeg FFmpeg vulnerability
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using FFmpeg versions before 9.0 are affected in the WMA encoder extradata allocation paths in libavcodec/wmaenc.c. Exploitation requires local access and high attack complexity according to the supplied vector.
Does exploiting this require authentication or user interaction?
The vector indicates no privileges are required and no user interaction is required. The attack vector is local, so an attacker still needs the ability to execute or trigger relevant processing on the affected system.
What is the impact if exploitation succeeds?
The reported impact is limited to availability, with no confidentiality or integrity impact indicated. The issue is an out-of-bounds read caused by missing required padding in WMA extradata allocation paths.