CVE-2026-52297: Low severity FFmpeg FFmpeg vulnerability
Published Sep 13, 2026
·Updated
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c.
Affected Software
1 affected component
FFmpeg FFmpeg<9.0
Event History
Sep 13, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed?
Systems using FFmpeg versions before 9.0 are affected when they process MOV content through the affected MOV parsing path.
2
What does an attacker need to exploit this issue?
The vector is local and exploitation has high attack complexity. No privileges or user interaction are required according to the provided severity vector.
3
What is the expected security impact?
The reported impact is limited to low availability impact. No confidentiality or integrity impact is indicated.
4
How can I determine whether remediation is needed?
Check the FFmpeg version in use. Versions before 9.0 require remediation; version 9.0 or later is not listed as affected.