CVE-2026-107676

Published: Ott 08, 2026 Last Modified: Ott 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 3,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.

908

Use of Uninitialized Resource

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability
Potential Impacts:
Read Memory Read Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795…
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc4…
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590
https://ffmpeg.org/
https://ffmpeg.org/
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_…
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L…
https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-u…
https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-…