Out-of-bounds read in FFmpeg - CVE-2026-30997

Vulnerability identifier: #VU135067

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-30997

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition within the read_global_param() function in libavcodec/av1dec.c. A remote attacker can create a specially crafted media content to the application, trigger an out-of-bounds read error and perform a denial of service attack.

FFmpeg
Debian Linux
openEuler
ffmpeg
ffmpeg-debuginfo
ffmpeg-debugsource
ffmpeg-devel
ffmpeg-libs
libavdevice
ffmpeg (Debian package)

Install updates from vendor's website.

FFmpeg - update to 8.0.2
ffmpeg - update to 6.1.1-27
ffmpeg-debuginfo - update to 6.1.1-27
ffmpeg-debugsource - update to 6.1.1-27
ffmpeg-devel - update to 6.1.1-27
ffmpeg-libs - update to 6.1.1-27
libavdevice - update to 6.1.1-27
ffmpeg (Debian package) - update to 7:7.1.5-0+deb13u1

• https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f

• Denial of service in FFmpeg
• Debian update for ffmpeg
• openEuler 24.03 LTS SP3 update for ffmpeg