Vulnerability · Published Sep 14, 2026 · Assigned by VulDB
CVE-2026-90815FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds
Medium 6.3
In plain English
A medium-severity out-of-bounds read in FFmpeg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ffmpeg | 7:5.1.9-0+deb12u1 | DEBIAN-CVE-2026-90815 |
| Debian:13 | ffmpeg | 7:7.1.4-0+deb13u1 | DEBIAN-CVE-2026-90815 |
| Debian:14 | ffmpeg | 7:8.1-1 | DEBIAN-CVE-2026-90815 |
| Ubuntu:26.10 | ffmpeg | no fix listed | UBUNTU-CVE-2026-90815 |
Affected products (as reported)
Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-403317 | FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds vdb-entry, technical-description
- VDB-403317 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-90815 | CVE Analysis and Report third-party-advisory
- Submit #922609 | FFmpeg FFmpeg Affected versions: FFmpeg 3.0 and later, prior to the inclusion of commits 8970658472 and e24b9820b4 (merged around late Februar Out-of-Bounds Read third-party-advisory
- https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487 exploit, issue-tracking
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1 patch
- https://ffmpeg.org/ product