CVE-2026-90815

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in FFmpeg Convolution Filter

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-03

NVD

CVE-2026-90815

EUVD

EUVD-2026-77791

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	to 4.4.6 (inc)
ffmpeg	ffmpeg	to 5.1.8 (inc)
ffmpeg	ffmpeg	to 6.1.4 (inc)
ffmpeg	ffmpeg	to 7.1.3 (inc)
ffmpeg	ffmpeg	to 8.0.1 (inc)
ffmpeg	ffmpeg	to 9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in FFmpeg's Convolution Filter component. It exists in the function setup_3x3 within the file libavfilter/vf_convolution.c. An attacker can remotely exploit this flaw to read memory outside the intended bounds, potentially accessing sensitive data.

Detection Guidance

This vulnerability affects FFmpeg versions up to 4.4.6, 5.1.8, 6.1.4, 7.1.3, and 8.0.1 due to an out-of-bounds read in the convolution filter. To detect it, check the installed FFmpeg version using 'ffmpeg -version'. If it is below 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, or 9.0, the system is vulnerable.

Impact Analysis

The vulnerability allows remote attackers to read memory outside allocated bounds. This could lead to information disclosure, crashes, or unintended behavior in applications using affected FFmpeg versions. Users should upgrade to patched versions to mitigate risks.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves an out-of-bounds read in FFmpeg's convolution filter, which could potentially lead to information disclosure or other security issues. However, no explicit connection to regulatory compliance is mentioned.

Mitigation Strategies

Upgrade FFmpeg to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 or 9.0 to resolve the out-of-bounds read vulnerability in the Convolution Filter component.

Hi! I’m here to help you understand CVE-2026-90815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70