CVE-2026-52295

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in FFmpeg via IAMF Writer

Publication date: 2026-09-01

Last updated on: 2026-09-13

Assigner: MITRE

Description

FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-13

Generated

2026-09-22

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-52295

EUVD

EUVD-2026-69409

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	From 7.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in FFmpeg versions 7.0 and later. It occurs in the libavformat/iamf_writer.c component due to insufficient padding in extradata buffers before bitreader access. This can lead to heap out-of-bounds reads, causing crashes or denial-of-service conditions when processing specially crafted inputs.

Detection Guidance

Detecting this vulnerability requires checking FFmpeg versions and analyzing code for extradata padding issues. Use commands like 'ffmpeg -version' to verify installed versions and compare against patched releases. Inspect logs for crashes or denial-of-service events during media processing.

Impact Analysis

An attacker could exploit this flaw to crash applications using affected FFmpeg versions, leading to denial-of-service conditions. This may disrupt media processing tasks, cause system instability, or require restarting services that rely on FFmpeg for audio/video handling.

Compliance Impact

The vulnerability causes denial of service via buffer overflow, which could disrupt systems handling sensitive data. This may impact compliance with GDPR (availability principle) or HIPAA (integrity and availability requirements) if services fail due to crashes.

Mitigation Strategies

Immediately update FFmpeg to the latest patched version from the official repository. Avoid processing untrusted media files until updated. Monitor system logs for crashes or unusual behavior during media operations.

Hi! I’m here to help you understand CVE-2026-52295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70