USN-8671-1: FFmpeg vulnerabilities
Adrian Junge was discovered that FFmpeg incorrectly handled certain media files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-66036, CVE-2026-66039) Adrian Junge discovered that FFmpeg incorrectly handled certain media files. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66038)
CSIRTS triage
- What
- FFmpeg incorrectly handles certain media files, allowing denial of service, arbitrary code execution, or information disclosure.
- Who is affected
- Users processing untrusted media files with FFmpeg.
- Urgency
- Moderate to High — multiple vulnerability types including potential RCE, but no exploitation status reported.
- Action
- Update FFmpeg to a patched version addressing CVE-2026-66036, CVE-2026-66039, and CVE-2026-66038.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FFmpeg
Get an email when a new FFmpeg advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8671-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-660360.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-660390.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-660380.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-66036 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-66039 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-66038 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] ffmpeg: Multiple vulnerabilitiescert-bund
- highCVE-2026-66039: FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerabilit…nvd
- mediumCVE-2026-66038: FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerabilit…nvd
- highCVE-2026-66036: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerabili…nvd
More from Ubuntu Security Notices
- unknownUSN-8659-4: Linux kernel (Oracle) vulnerability2026-08-26
- unknownUSN-8666-2: Linux kernel (Azure) vulnerabilities2026-08-25
- unknownUSN-8630-5: Linux kernel (Raspberry Pi) vulnerabilities2026-08-25
- unknownUSN-8658-3: Linux kernel vulnerabilities2026-08-25
- unknownUSN-8643-4: Linux kernel vulnerabilities2026-08-25