In plain language
What this advisory means
Multiple security flaws were found in FFmpeg, a media handling tool in Ubuntu. These flaws could be triggered by specially crafted media files to crash FFmpeg, disrupt services, leak sensitive data, or run harmful code on your system. Various Ubuntu versions, such as 18.04, 20.04, 22.04, and 24.04 LTS, are affected depending on the issue. Users should update their FFmpeg packages to secure their systems.
Technical explanation
How the issue affects the environment
FFmpeg contained multiple vulnerabilities caused by improper processing of specially crafted media inputs across several components, including the VobSub subtitle demuxer, S/PDIF muxer, RTP/ASF streams, ADX audio files, TDSC video decoder, TY demuxer, vf_floodfill and vf_swaprect video filters, HEVC parser, MPEG system headers, librist protocol handler, VC2 HQ RTP packetizer, and DASH manifests. These issues allowed attackers to cause denial of service, potentially execute arbitrary code with the same privileges as the FFmpeg process, or disclose sensitive information. The affected Ubuntu distributions range from 18.04 LTS through 24.04 LTS, with some flaws specific to particular versions. The Ubuntu Security Notice USN-8716-1 lists CVEs from CVE-2026-64830 through CVE-2026-75146. Ubuntu recommends updating to patched package versions available via Ubuntu Pro Extended Security Maintenance (ESM) or applying community fixes should they become available.
Operational impact
Why teams should care
Organizations using FFmpeg for media processing on Ubuntu systems risk service outages due to crashes or denial of service attacks. Furthermore, certain vulnerabilities enable attackers to run unauthorized code or access confidential data, potentially compromising system integrity and confidentiality. These risks can impact media handling services, streaming platforms, or any system that processes untrusted media files, leading to potential downtime, data breaches, or reputational damage.
Immediate action
To address these vulnerabilities, users should update FFmpeg and related libraries to the patched package versions provided by Ubuntu Pro Extended Security Maintenance (ESM). If Ubuntu Pro is not available, users should monitor for and apply community-provided fixes. Updates include newer versions of ffmpeg, libavcodec, libavfilter, libavformat packages curated to close the vulnerabilities.
Affected and fixed releases
Temporary risk reduction
The official source does not specify any workaround other than applying updates. Users should avoid processing untrusted or maliciously crafted media files until patches are applied to reduce risk.
Evidence and validation checklist
- Ubuntu Security Notice USN-8716-1 details multiple CVEs with explanations of improper handling of crafted media leading to denial of service, code execution, or information leaks.
- Affected Ubuntu versions and packages are specified, with fix instructions referencing Ubuntu Pro ESM packages.
- No mention in the notice of active exploitation or workaround instructions beyond updating packages.
- Multiple types of crafted media inputs trigger the issues: subtitles, audio streams, video data, network input, and manifests.
Authoritative reference
Ubuntu Security Notices
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.