CVE Tracker

CVE-2026-30754 @ Saiph

Status
new
Priority
1.32
Match score
4.0
Risk
MemCorrupt Remote priv:user
CVSS
8.8 HIGH
Reason
cpe: ffmpeg; pkgs: ffmpeg; version: in-range: ffmpeg-4.1.11-0+deb10u1; risk:memory_corruption
Created
2026-10-16T10:16:51Z
Updated
2026-10-20T10:18:00Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
ffmpeg-4.1.11-0+deb10u1
ffmpeg-7:4.1.11-0+deb10u1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: ffmpeg

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
Debian GNU/Linux 10 (buster) (10) · debian
Arch
x86_64
kernel_release
uname -r → 4.19.0-27-amd64
kernel_version
uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.

Update status

Add note only

References

NVD: CVE-2026-30754