MEDIUM

CVE-2026-90815

2026-09-14 CVSS v3.1

CVSS

6.3

Description

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.

Weakness (CWE)

CWE-119 Memory Buffer Bounds Error

CWE-125 Out-of-bounds Read

EPSS Score

0.24%

Probability of exploitation in next 30 days

15.7th percentile

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1 https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487 https://ffmpeg.org/ https://vuldb.com/cve/CVE-2026-90815 https://vuldb.com/submit/922609 https://vuldb.com/vuln/403317 https://vuldb.com/vuln/403317/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE