FFmpeg CVE-2026-52296

Exploitation requires local access to a system running FFmpeg and the ability to supply crafted input to the WMA encoding path in libavcodec/wmaenc.c. The affected code is reached only when encoding WMA audio and only when extradata allocation is exercised with parameters that expose the missing padding; passive WMA playback or decoding does not trigger this path. Exploitation is further constrained by high attack complexity (AC:H), meaning specific allocation conditions must be met. Authentication requirements are not confirmed from CVSS PR:N alone, as that metric reflects OS-level privilege rather than application-level authentication. The flaw is not remotely exploitable via network access and does not affect confidentiality or integrity.

The CVSS base score of 2.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately characterizes this as a low-severity, locally-triggered issue with high attack complexity and no confidentiality or integrity impact. EPSS data is absent from the provided intelligence, but given the low CVSS, local-only vector, and high complexity, exploitation probability is expected to be negligible. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis. Even a mid-sized municipal IT team in zabrze operating a media transcoding pipeline would face minimal operational exposure, since exploitation requires local access and specifically crafted WMA encoder extradata rather than passive media playback. Notably, the source data tags this as 'Information Disclosure,' which directly conflicts with the CVSS C:N metric - that tag appears mislabeled. The 'Buffer Overflow' tag loosely applies but overstates write-side risk; CWE-125 is an out-of-bounds read, not a write-based overflow. Real-world priority is low except for services that accept fully untrusted WMA encoding parameters from external callers.

An attacker with local access to a system running an FFmpeg-based transcoding service supplies a crafted media container whose WMA encoder extradata is sized to trigger the missing-padding condition in wmaenc.c. When the encoder processes this input, the out-of-bounds read occurs, crashing the encoding process. No public exploit code exists at time of analysis, and the high attack complexity requirement means reliable triggering demands precise knowledge of the allocation layout.