Disclosure summary
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
Source-reported weakness categories
CWE-908
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107676
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
- NIST NVD record
- CVE Program record
- code.ffmpeg.org
- code.ffmpeg.org
- ffmpeg.org
- github.com
- www.vulncheck.com
PUBLISHED 2026-10-08T12:17:05-04:00
MODIFIED 2026-10-08T17:04:38-04:00
INGESTED 2026-10-10T20:55:03-04:00