An update for ffmpeg is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4474 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 ffmpeg security update An update for ffmpeg is now available for openEuler-24.03-LTS-SP4 FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fix(es): FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.(CVE-2026-107660) FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.(CVE-2026-107675) FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.(CVE-2026-107676) FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.(CVE-2026-107677) FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.(CVE-2026-107695) FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.(CVE-2026-107696) FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.(CVE-2026-107697) An update for ffmpeg is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High ffmpeg https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107660 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107675 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107676 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107677 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107695 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107696 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107697 https://nvd.nist.gov/vuln/detail/CVE-2026-107660 https://nvd.nist.gov/vuln/detail/CVE-2026-107675 https://nvd.nist.gov/vuln/detail/CVE-2026-107676 https://nvd.nist.gov/vuln/detail/CVE-2026-107677 https://nvd.nist.gov/vuln/detail/CVE-2026-107695 https://nvd.nist.gov/vuln/detail/CVE-2026-107696 https://nvd.nist.gov/vuln/detail/CVE-2026-107697 openEuler-24.03-LTS-SP4 ffmpeg-6.1.1-53.oe2403sp4.src.rpm ffmpeg-6.1.1-53.oe2403sp4.x86_64.rpm ffmpeg-debuginfo-6.1.1-53.oe2403sp4.x86_64.rpm ffmpeg-debugsource-6.1.1-53.oe2403sp4.x86_64.rpm ffmpeg-devel-6.1.1-53.oe2403sp4.x86_64.rpm ffmpeg-libs-6.1.1-53.oe2403sp4.x86_64.rpm libavdevice-6.1.1-53.oe2403sp4.x86_64.rpm ffmpeg-6.1.1-53.oe2403sp4.aarch64.rpm ffmpeg-debuginfo-6.1.1-53.oe2403sp4.aarch64.rpm ffmpeg-debugsource-6.1.1-53.oe2403sp4.aarch64.rpm ffmpeg-devel-6.1.1-53.oe2403sp4.aarch64.rpm ffmpeg-libs-6.1.1-53.oe2403sp4.aarch64.rpm libavdevice-6.1.1-53.oe2403sp4.aarch64.rpm FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams. 2026-10-22 CVE-2026-107660 openEuler-24.03-LTS-SP4 Medium 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output. 2026-10-22 CVE-2026-107675 openEuler-24.03-LTS-SP4 Medium 5.9 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files. 2026-10-22 CVE-2026-107676 openEuler-24.03-LTS-SP4 Medium 4.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely. 2026-10-22 CVE-2026-107677 openEuler-24.03-LTS-SP4 Medium 4.7 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption. 2026-10-22 CVE-2026-107695 openEuler-24.03-LTS-SP4 High 7.1 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core. 2026-10-22 CVE-2026-107696 openEuler-24.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block. 2026-10-22 CVE-2026-107697 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N ffmpeg security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4474