RHSA-2026:74089
- Source
- https://access.redhat.com/errata/RHSA-2026:74089
- Import Source
- https://security.access.redhat.com/data/osv/RHSA-2026:74089.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/RHSA-2026:74089
- Upstream
- Published
- 2026-10-01T10:21:19Z
- Modified
- 2026-10-02T10:25:42Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Red Hat Security Advisory: RHEL AI 3.0 RPM runtime CVE fix - ffmpeg
- Details
- References
-
- https://access.redhat.com/errata/RHSA-2026:74089
- https://access.redhat.com/security/updates/classification/#moderate
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74089.json
- https://access.redhat.com/security/cve/CVE-2026-8461
- https://bugzilla.redhat.com/show_bug.cgi?id=2490308
- https://www.cve.org/CVERecord?id=CVE-2026-8461
- https://nvd.nist.gov/vuln/detail/CVE-2026-8461
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159
- https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
- https://access.redhat.com/security/cve/CVE-2026-40962
- https://bugzilla.redhat.com/show_bug.cgi?id=2458862
- https://www.cve.org/CVERecord?id=CVE-2026-40962
- https://nvd.nist.gov/vuln/detail/CVE-2026-40962
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348
- https://access.redhat.com/security/cve/CVE-2026-58049
- https://bugzilla.redhat.com/show_bug.cgi?id=2493952
- https://www.cve.org/CVERecord?id=CVE-2026-58049
- https://nvd.nist.gov/vuln/detail/CVE-2026-58049
- https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c
- https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
- https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta
- https://access.redhat.com/security/cve/CVE-2026-64830
- https://bugzilla.redhat.com/show_bug.cgi?id=2506193
- https://www.cve.org/CVERecord?id=CVE-2026-64830
- https://nvd.nist.gov/vuln/detail/CVE-2026-64830
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657
- https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer
- https://access.redhat.com/security/cve/CVE-2026-64834
- https://bugzilla.redhat.com/show_bug.cgi?id=2506191
- https://www.cve.org/CVERecord?id=CVE-2026-64834
- https://nvd.nist.gov/vuln/detail/CVE-2026-64834
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663
- https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer
- https://access.redhat.com/security/cve/CVE-2026-64835
- https://bugzilla.redhat.com/show_bug.cgi?id=2506195
- https://www.cve.org/CVERecord?id=CVE-2026-64835
- https://nvd.nist.gov/vuln/detail/CVE-2026-64835
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659
- https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder
- https://access.redhat.com/security/cve/CVE-2026-66036
- https://bugzilla.redhat.com/show_bug.cgi?id=2506909
- https://www.cve.org/CVERecord?id=CVE-2026-66036
- https://nvd.nist.gov/vuln/detail/CVE-2026-66036
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783
- https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter
- https://access.redhat.com/security/cve/CVE-2026-66039
- https://bugzilla.redhat.com/show_bug.cgi?id=2506937
- https://www.cve.org/CVERecord?id=CVE-2026-66039
- https://nvd.nist.gov/vuln/detail/CVE-2026-66039
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631
- https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file