CVE-2026-52297

Received Received - Intake

Out-of-Bounds Read in FFmpeg Due to Insufficient Extradata Padding

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-52297

EUVD

EUVD-2026-77134

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	to 9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in FFmpeg versions before 9.0. It occurs during the parsing of MOV files when there is insufficiently padded extradata in the MOV parsing path, specifically in the mov_read_iacb function within libavformat/mov.c.

Impact Analysis

This vulnerability may allow an attacker to read memory outside the intended buffer, potentially leading to information disclosure or crashes. It requires local access to exploit and has a low impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is an out-of-bounds read issue in FFmpeg's MOV parsing. However, if exploited, it could lead to crashes or unexpected behavior in software processing media files, potentially causing data corruption or denial of service. Such disruptions might indirectly impact systems handling sensitive data under GDPR or HIPAA by compromising availability or integrity.

Mitigation Strategies

Update FFmpeg to version 9.0 or later to address the out-of-bounds read vulnerability in MOV parsing.

Hi! I’m here to help you understand CVE-2026-52297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70