Skip to main content

FFmpeg CVE-2026-6385

| EUVDEUVD-2026-23098 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-04-15 redhat
RCE Buffer Overflow Denial Of Service Integer Overflow Red Hat Openshift Ai Rhoai Lightspeed Core Red Hat Ai Inference Server Red Hat Enterprise Linux Ai Rhel Ai 3 Red Hat
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network attack vector with low complexity, no privileges, but user interaction required; availability impact high, no confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 26, 2026 - 15:09 vuln.today
Patch released
Apr 19, 2026 - 14:30 nvd
Patch available
EUVD ID Assigned
Apr 15, 2026 - 19:45 euvd
EUVD-2026-23098
CVE Published
Apr 15, 2026 - 19:18 nvd
MEDIUM 6.5

DescriptionCVE.org

A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.

AnalysisAI

A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).

Technical ContextAI

The vulnerability resides in FFmpeg's MPEG-PS/VOB demuxer, specifically within the DVD subtitle (VobSub) decoder. When reassembling fragmented subtitle packets, a signed integer overflow in the bounds-checking logic allows undersized memory allocation, leading to a heap buffer overwrite. This is classified as CWE-190 (Integer Overflow or Wraparound). The affected functionality is part of the core libavformat library, used by countless applications including media players, transcoders, and streaming servers. Red Hat products like Lightspeed Core, AI Inference Server, RHEL AI, and OpenShift AI are confirmed affected due to their bundling of FFmpeg (CPE data).

RemediationAI

Apply the vendor-released patch by upgrading FFmpeg to the latest version that addresses CVE-2026-6385. For Red Hat products, consult the advisory at https://access.redhat.com/security/cve/CVE-2026-6385 for specific fixed package versions (e.g., updated containers or RPMs). If immediate patching is not possible, a temporary workaround is to disable DVD subtitle decoding in FFmpeg-based applications (e.g., using '-an' or '-sn' flags to skip subtitle streams, or recompiling FFmpeg without VobSub support), though this may break legitimate subtitle playback.

More in Red Hat Openshift Ai Rhoai

View all
CVE-2026-23536 HIGH POC
7.5 Mar 20

The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
CVE-2026-18948 CRITICAL
9.9 Aug 10

Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
CVE-2026-14450 CRITICAL
9.9 Aug 10

Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
CVE-2026-5483 CRITICAL
9.9 Apr 10

Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
CVE-2026-15143 CRITICAL
9.3 Jul 10

Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat

CVE-2026-23537 CRITICAL
9.1 Jul 01

Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
CVE-2026-18951 HIGH
8.8 Aug 10

Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
CVE-2026-18982 HIGH
8.8 Aug 10

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or

CVE-2026-18617 HIGH
8.8 Aug 10

MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
CVE-2026-18950 HIGH
8.8 Aug 10

Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
CVE-2026-18949 HIGH
8.8 Aug 10

Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
CVE-2026-13717 HIGH
8.8 Aug 10

The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-6385 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy