USN-8915-1: FFmpeg vulnerabilities

Publication date

12 October 2026

Overview

Several security issues were fixed in FFmpeg.


Packages

  • ffmpeg - Tools for transcoding, streaming and playing of multimedia files

Details

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain
memory operations. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-30754)

It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-38344)

It was discovered that FFmpeg did not correctly handle certain arithmetic
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-38346, CVE-2026-38348, CVE-2026-38349)

It was discovered that FFmpeg did not correctly handle certain...

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain
memory operations. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-30754)

It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-38344)

It was discovered that FFmpeg did not correctly handle certain arithmetic
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-38346, CVE-2026-38348, CVE-2026-38349)

It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38347)

It was discovered that FFmpeg did not correctly handle certain arithmetic
operations. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38350)

Joshua Rogers discovered that FFmpeg did not correctly handle certain
memory operations. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-75147)


Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute ffmpeg –  7:8.0.1-3ubuntu2+esm5  
libavcodec-extra62 –  7:8.0.1-3ubuntu2+esm5  
libavcodec62 –  7:8.0.1-3ubuntu2+esm5  
libavfilter-extra11 –  7:8.0.1-3ubuntu2+esm5  
libavfilter11 –  7:8.0.1-3ubuntu2+esm5  
libavformat-extra62 –  7:8.0.1-3ubuntu2+esm5  
libavformat62 –  7:8.0.1-3ubuntu2+esm5  
24.04 LTS noble ffmpeg –  7:6.1.1-3ubuntu5+esm15  
libavcodec-extra60 –  7:6.1.1-3ubuntu5+esm15  
libavcodec60 –  7:6.1.1-3ubuntu5+esm15  
libavfilter-extra9 –  7:6.1.1-3ubuntu5+esm15  
libavfilter9 –  7:6.1.1-3ubuntu5+esm15  
libavformat-extra60 –  7:6.1.1-3ubuntu5+esm15  
libavformat60 –  7:6.1.1-3ubuntu5+esm15  
22.04 LTS jammy ffmpeg –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavcodec-extra58 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavcodec58 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavfilter-extra7 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavfilter7 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavformat-extra58 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
libavformat58 –  7:4.4.2-0ubuntu0.22.04.1+esm17  
20.04 LTS focal ffmpeg –  7:4.2.7-0ubuntu0.1+esm18  
libavcodec-extra58 –  7:4.2.7-0ubuntu0.1+esm18  
libavcodec58 –  7:4.2.7-0ubuntu0.1+esm18  
libavfilter-extra7 –  7:4.2.7-0ubuntu0.1+esm18  
libavfilter7 –  7:4.2.7-0ubuntu0.1+esm18  
libavformat58 –  7:4.2.7-0ubuntu0.1+esm18  
18.04 LTS bionic ffmpeg –  7:3.4.11-0ubuntu0.1+esm16  
libavcodec-extra57 –  7:3.4.11-0ubuntu0.1+esm16  
libavcodec57 –  7:3.4.11-0ubuntu0.1+esm16  
libavfilter-extra6 –  7:3.4.11-0ubuntu0.1+esm16  
libavfilter6 –  7:3.4.11-0ubuntu0.1+esm16  
libavformat57 –  7:3.4.11-0ubuntu0.1+esm16  
16.04 LTS xenial ffmpeg –  7:2.8.17-0ubuntu0.1+esm18
libav-tools –  7:2.8.17-0ubuntu0.1+esm18
libavcodec-ffmpeg-extra56 –  7:2.8.17-0ubuntu0.1+esm18
libavcodec-ffmpeg56 –  7:2.8.17-0ubuntu0.1+esm18
libavfilter-ffmpeg5 –  7:2.8.17-0ubuntu0.1+esm18
libavformat-ffmpeg56 –  7:2.8.17-0ubuntu0.1+esm18

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›