Vulnerability · Published Sep 23, 2026 · Assigned by mitre
CVE-2026-96611
Medium 6.9
In plain English
A medium-severity integer overflow in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | ffmpeg | 7:7.1.5-0+deb13u1 | DEBIAN-CVE-2026-96611 |
| Debian:14 | ffmpeg | 7:8.1.2-1 | DEBIAN-CVE-2026-96611 |
| Ubuntu:26.10 | ffmpeg | no fix listed | UBUNTU-CVE-2026-96611 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L