CVE-2026-90815
mediumA vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1.
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1 cna@vuldb.com
- https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487 cna@vuldb.com
- https://ffmpeg.org/ cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-90815 cna@vuldb.com
- https://vuldb.com/submit/922609 cna@vuldb.com
- https://vuldb.com/vuln/403317 cna@vuldb.com
- https://vuldb.com/vuln/403317/cti cna@vuldb.com
- https://vuldb.com/submit/922609 134c704f-9b21-4f2e-91b3-4a467353bcc0