FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74089 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21211-1 advisory.

    This update for ffmpeg-7 fixes the following issues

    - CVE-2026-40962: inadequate CENC subsample bounds checks can lead to an integer overflow (bsc#1262237).

    Changes for ffmpeg-7:

    - Update to version 7.1.4:
     * Codec, format, filter and various other bugfixes.
     * lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10
     * swscale/output: Fix integer overflow in yuv2ya16_X_c_template()
     * avformat/avformat: clear FFFormatContext packet queue when      closing a muxer

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8469-1 advisory.

    Jiasheng Jiang discovered that FFmpeg incorrectly handled memory in certain error-handling paths of its     TensorFlow DNN backend. An attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 24.04 LTS. (CVE-2025-12343)

    Quang Luong discovered that FFmpeg incorrectly handled certain subsample data. An attacker could possibly     use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-40962)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2444-1 advisory.

    This update for ffmpeg-4 fixes the following issues

    Update to version 4.4.7:

    - CVE-2023-6601: HLS Unsafe File Extension Bypass (bsc#1220545).
    - CVE-2024-35366: FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options     function of sbgdec.c       within the libavformat module. When parsing certain options, the software does not adequately validate     the i       (bsc#1234030).
    - CVE-2025-1594: stack-based buffer overflow in function ff_aac_search_for_tns of the file     libavcodec/aacenc_tns.c of       the component AAC Encoder (bsc#1237561).
    - CVE-2025-9951: heap-based buffer overflow in jpeg2000dec (bsc#1249393).
    - CVE-2025-10256: NULL pointer dereference in Firequalizer filter (bsc#1249431).
    - CVE-2025-63757: accumulation of filtered pixel values can lead to an integer overflow (bsc#1255392).
    - CVE-2026-30997: Denial of Service via out-of-bounds read (bsc#1262047).
    - CVE-2026-40962: inadequate CENC subsample bounds checks can lead to an integer overflow (bsc#1262237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2445-1 advisory.

    This update for ffmpeg-4 fixes the following issues

    Update to version 4.4.7:

    - CVE-2023-6601: HLS Unsafe File Extension Bypass (bsc#1220545).
    - CVE-2024-35366: FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options     function of sbgdec.c       within the libavformat module. When parsing certain options, the software does not adequately validate     the i       (bsc#1234030).
    - CVE-2025-1594: stack-based buffer overflow in function ff_aac_search_for_tns of the file     libavcodec/aacenc_tns.c of       the component AAC Encoder (bsc#1237561).
    - CVE-2025-9951: heap-based buffer overflow in jpeg2000dec (bsc#1249393).
    - CVE-2025-10256: NULL pointer dereference in Firequalizer filter (bsc#1249431).
    - CVE-2025-63757: accumulation of filtered pixel values can lead to an integer overflow (bsc#1255392).
    - CVE-2026-30997: Denial of Service via out-of-bounds read (bsc#1262047).
    - CVE-2026-40962: inadequate CENC subsample bounds checks can lead to an integer overflow (bsc#1262237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20726-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2026-40962: Fixed inadequate CENC subsample bounds checks that could lead to an integer overflow     (bsc#1262237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption)     subsample data to libavformat/mov.c. (CVE-2026-40962)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
353427	RHEL 9 : RHEL AI 3.0 RPM runtime CVE fix - ffmpeg (Moderate) (RHSA-2026:74089)	Nessus	Red Hat Local Security Checks	Local	high
325043	openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21211-1)	Nessus	SuSE Local Security Checks	Local	high
322791	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : FFmpeg vulnerabilities (USN-8469-1)	Nessus	Ubuntu Local Security Checks	Local	critical
321754	SUSE SLES15 Security Update : ffmpeg-4 (SUSE-SU-2026:2444-1)	Nessus	SuSE Local Security Checks	Local	high
321694	SUSE SLED15 / SLES15 Security Update : ffmpeg-4 (SUSE-SU-2026:2445-1)	Nessus	SuSE Local Security Checks	Local	high
315035	openSUSE 16 Security Update : ffmpeg-4 (openSUSE-SU-2026:20726-1)	Nessus	SuSE Local Security Checks	Local	critical
306839	Linux Distros Unpatched Vulnerability : CVE-2026-40962	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-40962

critical

Tenable Plugins

high

high

critical

high

high

critical

critical