CVE-2026-30997
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Apr 13, 2026
CISA due date
—
The record
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | ffmpeg-4 | 0 | 4.4.7-3.1 |
| openSUSE:Tumbleweed | ffmpeg-7 | 0 | 7.1.4-3.1 |
| openSUSE:Tumbleweed | ffmpeg-8 | 0 | 8.1.1-3.1 |
Related vulnerabilities
- CVE-2026-40962 FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC… Also affects ffmpeg-4
- CVE-2025-10256 A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter… Also affects ffmpeg-4
- CVE-2025-63757 Integer overflow vulnerability in the yuv2ya16_X_c_template function in… Also affects ffmpeg-4
- CVE-2025-7700 A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for… Also affects ffmpeg-4
- CVE-2025-0518 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive… Also affects ffmpeg-4
- CVE-2023-6601 A flaw was found in FFmpeg's HLS demuxer. Also affects ffmpeg-4
- CVE-2024-36613 FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing… Also affects ffmpeg-4
- CVE-2024-35368 FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within… Also affects ffmpeg-4