CVE-2026-40962
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Published Apr 16, 2026 · updated Jun 17, 2026 · ffmpeg ffmpeg
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 16, 2026 · NIST NVD
Detected
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Jun 17, 2026 · NIST NVD
Updated
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
Affected
- cpe ffmpeg/ffmpegversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40962
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40962
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
nvd.nist.gov