TI-2026-61718 Aliases CVE-2026-90815 GHSA-9wrf-27jr-f8f5

FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

MEDIUM 57CWE-119Published 2026-09-14 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00422 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Partial FFmpeg: 4.4.7, 5.1.9, 6.1.5 +4Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	FFmpeg	4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; 4.4.6; 5.1.0; 5.1.1; 5.1.2; 5.1.3; 5.1.4; 5.1.5; 5.1.6; 5.1.7; 5.1.8; 6.1.0; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 8.0.0; 8.0.1	4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, 9.0	Patch available	CNA

FFmpeg Vendor— Affected 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; 4.4.6; 5.1.0; 5.1.1; 5.1.2; 5.1.3; 5.1.4; 5.1.5; 5.1.6; 5.1.7; 5.1.8; 6.1.0; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 8.0.0; 8.0.1 Fixed in 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, 9.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ffmpeg:ffmpeg::::::::	—	—	FFmpeg

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* Versions — — ·FFmpeg

Remediation

Fix · CNA FFmpeg Fixed in 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, 9.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Enterprise Linux AI (RHEL AI) 3

Timeline

2026-10-02 Threatist record created from CVE-2026-90815
2026-10-03 Alias added: GHSA-9wrf-27jr-f8f5

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences