SUSE-SU-2026:3542-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20263542-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3542-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3542-1

Upstream

CVE (7)

Related

CVE (7)

Published

2026-08-10T12:50:29Z

Modified

2026-08-11T09:15:04Z

Summary

Security update for ffmpeg-4

Details

This update for ffmpeg-4 fixes the following issues:

Update to release 4.4.8.

CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution (bsc#1269490).
CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service (bsc#1268595).
CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution (bsc#1272752).
CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory corruption (bsc#1272754).
CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure and memory corruption (bsc#1272758).
CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to sensitive information disclosure (bsc#1272768).
CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and arbitrary code execution (bsc#1272765).

Other updates and bugfixes:

Release 4.4.8
- Various bug fixes to codecs
- avcodec/magicyuv: Fix 1 line MEDIAN slices
- avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
- avcodec/magicyuv: reject slice_height misaligned with chroma vshift

References

Affected packages

SUSE:Linux Enterprise Module for Package Hub 15 SP7

ffmpeg-4

Package

Name: ffmpeg-4
Purl: pkg:rpm/suse/ffmpeg-4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.4.8-150600.13.52.1

Ecosystem specific

{
    "binaries":  [
        {
            "ffmpeg-4":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavcodec-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavdevice-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavfilter-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavformat-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavresample-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libavutil-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libpostproc-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libswresample-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-libswscale-devel":  "4.4.8-150600.13.52.1",
            "ffmpeg-4-private-devel":  "4.4.8-150600.13.52.1",
            "libavcodec58_134":  "4.4.8-150600.13.52.1",
            "libavdevice58_13":  "4.4.8-150600.13.52.1",
            "libavfilter7_110":  "4.4.8-150600.13.52.1",
            "libavformat58_76":  "4.4.8-150600.13.52.1",
            "libavresample4_0":  "4.4.8-150600.13.52.1",
            "libavutil56_70":  "4.4.8-150600.13.52.1",
            "libpostproc55_9":  "4.4.8-150600.13.52.1",
            "libswresample3_9":  "4.4.8-150600.13.52.1",
            "libswscale5_9":  "4.4.8-150600.13.52.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3542-1.json"

SUSE:Linux Enterprise Workstation Extension 15 SP7