CVE-2026-52295
Received Received - Intake

Buffer Overflow in FFmpeg via IAMF Writer

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: MITRE

Description
Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamf_writer.c component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-52295
EUVD
EUVD-2026-69409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg From 7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in FFmpeg versions 7.0 and later. It occurs in the libavformat/iamf_writer.c component due to insufficient padding in extradata buffers before bitreader access. This can lead to heap out-of-bounds reads, causing crashes or denial-of-service conditions when processing specially crafted inputs.

Detection Guidance

Detecting this vulnerability requires checking FFmpeg versions and analyzing code for extradata padding issues. Use commands like 'ffmpeg -version' to verify installed versions and compare against patched releases. Inspect logs for crashes or denial-of-service events during media processing.

Impact Analysis

An attacker could exploit this flaw to crash applications using affected FFmpeg versions, leading to denial-of-service conditions. This may disrupt media processing tasks, cause system instability, or require restarting services that rely on FFmpeg for audio/video handling.

Compliance Impact

The vulnerability causes denial of service via buffer overflow, which could disrupt systems handling sensitive data. This may impact compliance with GDPR (availability principle) or HIPAA (integrity and availability requirements) if services fail due to crashes.

Mitigation Strategies

Immediately update FFmpeg to the latest patched version from the official repository. Avoid processing untrusted media files until updated. Monitor system logs for crashes or unusual behavior during media operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart