FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio
    decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by
    supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When
    AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the
    stream header but fails to update the internal channel state, causing subsequent decoding operations to
    access the prev[] state array using a stale channel count. (CVE-2026-64835)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3e109a0c85 advisory.

    Latest upstream bugfix release from 8.1 branch. Changes:
    https://code.ffmpeg.org/FFmpeg/FFmpeg/src/branch/release/8.1/Changelog .























Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74089 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8716-1 advisory.

    It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle     demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-64830)

    It was discovered that FFmpeg incorrectly handled certain crafted DTS audio streams in the S/PDIF muxer.
    An attacker could possibly use this issue to cause a denial of service or expose sensitive information.
    (CVE-2026-64833)

    It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF streams. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-64834)

    It was discovered that FFmpeg incorrectly handled certain crafted ADX audio files. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-64835)

    It was discovered that FFmpeg incorrectly handled certain crafted AVI files in the TDSC video decoder. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-65703)

    It was discovered that FFmpeg incorrectly handled certain crafted ffconcat files processed via the TY     demuxer. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
    (CVE-2026-65704)

    It was discovered that FFmpeg incorrectly handled certain crafted video streams in the vf_floodfill video     filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04     LTS. (CVE-2026-65705)

    It was discovered that FFmpeg incorrectly handled certain crafted NV12 video frames in the vf_swaprect     video filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu     24.04 LTS. (CVE-2026-65706)

    It was discovered that FFmpeg incorrectly handled certain crafted hvcC NAL arrays in the HEVC parser. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-75141)

    It was discovered that FFmpeg incorrectly handled certain crafted MPEG system headers. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-75142)

    It was discovered that FFmpeg incorrectly handled certain crafted network input in the librist protocol     handler. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143)

    It was discovered that FFmpeg incorrectly handled certain crafted Dirac data units in the VC2 HQ RTP     packetizer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. (CVE-2026-75144)

    It was discovered that FFmpeg incorrectly handled certain crafted DASH manifests. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21572-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
    - CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3542-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52832 advisory.

    CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or     denial of service via crafted ADX/AAX audio files     CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52833 advisory.

    CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or     denial of service via crafted ADX/AAX audio files     CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3529-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51180 advisory.

    CVE-2026-64835 FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted     ADX/AAX audio files     CVE-2026-58049 FFmpeg: Memory corruption via crafted RASC video stream

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758)
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754)
    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752)
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768)
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio     decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by     supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When     AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the     stream header but fails to update the internal channel state, causing subsequent decoding operations to     access the prev[] state array using a stale channel count. (CVE-2026-64835)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459090	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
459090	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
358433	Fedora 44 : ffmpeg (2026-3e109a0c85)	Nessus	Fedora Local Security Checks	Local	critical
353427	RHEL 9 : RHEL AI 3.0 RPM runtime CVE fix - ffmpeg (Moderate) (RHSA-2026:74089)	Nessus	Red Hat Local Security Checks	Local	high
344622	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8716-1)	Nessus	Ubuntu Local Security Checks	Local	critical
335498	openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21572-1)	Nessus	SuSE Local Security Checks	Local	high
334789	SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:3542-1)	Nessus	SuSE Local Security Checks	Local	high
334152	RHEL 9 : RHELAI 3.0 Backport fixes for CVE-2026-64835 and CVE-2026-58049 (Important) (RHSA-2026:52832)	Nessus	Red Hat Local Security Checks	Local	high
334148	RHEL 9 : RHELAI 3.2 Backport fixes for CVE-2026-64835 and CVE-2026-58049 (Important) (RHSA-2026:52833)	Nessus	Red Hat Local Security Checks	Local	high
333552	SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:3529-1)	Nessus	SuSE Local Security Checks	Local	high
333119	RHEL 9 : Backport fixes for CVE-2026-64835 and CVE-2026-58049 (Important) (RHSA-2026:51180)	Nessus	Red Hat Local Security Checks	Local	high
332106	openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)	Nessus	SuSE Local Security Checks	Local	high
329656	Linux Distros Unpatched Vulnerability : CVE-2026-64835	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64835

high

Tenable Plugins

high

high

critical

high

critical

high

high

high

high

high

high

high

high