CVE-2026-90815: FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 6.1.5 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 7.1.4 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 8.1.1 - Upgrade
Upgrade
FFmpeg (Convolution Filter - libavfilter/vf_convolution.c, setup_3x3)to a version that resolves this vulnerability.Fixed in 9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 8970658472/e24b9820b4
Event History
Frequently Asked Questions
Which FFmpeg releases contain the fix?
Upgrade to 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, or 9.0. The referenced patch is 8970658472/e24b9820b4.
Does exploitation require authentication or user interaction?
The CVSS vector indicates that no privileges are required, but user interaction is required. The attack vector is network-based.
What is the assessed impact if exploitation succeeds?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as low. The issue is described as an out-of-bounds read in the Convolution Filter's setup_3x3 function.