PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107676 FFmpeg CVE debrief

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35(). Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files. This vulnerability can lead to potential security risks, including leaked process memory in output files, and requires verification of FFmpeg versions and system configurations. Defenders should prioritize verifying FFmpeg versions and assessing exposure.

Vendor
FFmpeg
Product
Unknown
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Defenders responsible for FFmpeg installations, developers using FFmpeg in their applications, and security teams assessing exposure to this vulnerability should prioritize verifying FFmpeg versions and assessing exposure.

Why it matters

Defenders should prioritize verifying FFmpeg versions and assessing exposure due to the potential security risks associated with the uninitialized memory disclosure vulnerability.

  • Potential leaked process memory in output files
  • Verification of FFmpeg versions and system configurations required
  • Possible security risks due to uninitialized memory disclosure

Technical summary

The vulnerability is caused by an uninitialized memory disclosure in the av_dynamic_hdr_plus_to_t35() function, which leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. This can lead to potential security risks, including leaked process memory in output files. The vulnerability affects FFmpeg installations and requires verification of FFmpeg versions and system configurations to assess exposure. Defenders should prioritize verifying FFmpeg versions and assessing exposure, reviewing system configurations, and applying patches or mitigations as needed.

Defensive priority

Defenders should prioritize verifying FFmpeg versions and assessing exposure, reviewing system configurations, and applying patches or mitigations as needed.

Recommended defensive actions

  • Verify FFmpeg versions and assess exposure
  • Review system configurations and apply patches or mitigations as needed
  • Monitor output files for potential leaked process memory
  • Conduct a thorough review of system configurations to identify potential vulnerabilities
  • Implement compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions and retest remediated assets to ensure effective remediation
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability is caused by an uninitialized memory disclosure in the av_dynamic_hdr_plus_to_t35() function, which leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. The source item provides additional context on the vulnerability, including its potential impact on FFmpeg installations. To verify exposure, defenders should review system configurations and apply patches or mitigations as

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107676 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107676

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107676 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107676

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107676.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://ffmpeg.org/

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.