Red Hat Security Advisory

RHSA-2026:60335

RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

Released 2026-08-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AI 3.5 for RHEL 9 ffmpeg-6.1.6-7.el9ai, ffmpeg-free-rhai-6.1.6-7.el9ai, ffmpeg-free-rhai-devel-6.1.6-7.el9ai +16

Fixes 3 records

TI-2026-46359 CVE-2026-64834 · GHSA-5xcx-3qx2-qv4x

FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer

MEDIUM 45

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF strea…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00727 Published 2026-07-22 Fixed CWE-835

TI-2026-47028 CVE-2026-66039 · GHSA-84qc-6h9r-4w33

FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

LOW 39

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious byt…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00307 Published 2026-07-24 Fixed CWE-122

TI-2026-47025 CVE-2026-66036 · GHSA-575m-jfmw-q76c

FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

LOW 36

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution in…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00401 Published 2026-07-24 Fixed CWE-122