Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck
CVE-2026-107676FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
Low 3.3
In plain English
A low-severity security flaw in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ffmpeg | no fix listed | DEBIAN-CVE-2026-107676 |
| Debian:13 | ffmpeg | no fix listed | DEBIAN-CVE-2026-107676 |
| Debian:14 | ffmpeg | no fix listed | DEBIAN-CVE-2026-107676 |
| Ubuntu:26.10 | ffmpeg | no fix listed | UBUNTU-CVE-2026-107676 |
Affected products (as reported)
Weakness: CWE-908 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590 patch
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f patch
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385 technical-description
- https://ffmpeg.org/ product
- VulnCheck Advisory: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer third-party-advisory