The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758)
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754)
    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752)
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768)
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3529-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3552-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3542-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104795 advisory.

    FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle     demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle     file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers     can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the     vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution     in any application using FFmpeg's VobSub demuxer.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle     demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle     file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers     can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the     vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution     in any application using FFmpeg's VobSub demuxer. (CVE-2026-64830)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21572-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
    - CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
332106	openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)	Nessus	SuSE Local Security Checks	8/5/2026	8/7/2026	high
333552	SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:3529-1)	Nessus	SuSE Local Security Checks	8/9/2026	8/9/2026	high
334704	SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:3552-1)	Nessus	SuSE Local Security Checks	8/12/2026	8/12/2026	high
334789	SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:3542-1)	Nessus	SuSE Local Security Checks	8/12/2026	8/12/2026	high
340880	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104795)	Nessus	Unity Linux Local Security Checks	8/26/2026	8/26/2026	high
329587	Linux Distros Unpatched Vulnerability : CVE-2026-64830	Nessus	Misc.	7/25/2026	8/24/2026	high
335498	openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21572-1)	Nessus	SuSE Local Security Checks	8/15/2026	8/15/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high