CVE-2026-125230

FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm_rechunk Filter

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125231

FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125234

FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack_encode_init

FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate with many channels, to hang applications transcoding to WavPack.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125238

FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125240

FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper

FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decoder threads and buffers, exhausting memory.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125245

FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125252

FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125254

FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125258

FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125264

FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-125216

FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-86692

apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-77113 does not cover base64-encoded keys skipped by ProblemReport.load(binary=False), and ProblemReport.extract_keys() writes them to a file path built from the key without validation. This allows an attacker to create or overwrite arbitrary files writable by the invoking user, such as .bashrc or .profile, gaining persistence or code execution in that user's context.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Apport

CVE-2026-123813

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-123815

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-100129

Bridge | Out-of-bounds Write (CWE-787)

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Bridge Bridge Macos and 1 more

CVE-2026-100130

Substance3D - Sampler | Out-of-bounds Read (CWE-125)

Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Substance 3d Sampler Macos Windows

CVE-2026-100131

Substance3D - Sampler | Out-of-bounds Read (CWE-125)

Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Substance 3d Sampler Macos Windows

CVE-2026-92464

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-9764

IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Bob Bob Shell

CVE-2026-97702

Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role authorization check intended for this help-desk surface. Any authenticated learner can supply an email, username, or user_id for an arbitrary target and use the 200 and 404 response discrepancy to distinguish an active account from an absent or inactive account. A caller with a course-level or organization-level instructor role can additionally obtain the target user's staff or instructor assignments within the caller's course or organization scope. Anonymous callers remain blocked, and the separately authorized PUT behavior is outside this vulnerability. This issue is fixed in release/ulmo.4 and release/verawood.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openedx

Products

Openedx-platform