CVE-2026-40962

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
FFmpegFFmpeg>= 4.1, < 8.1

References

Timeline

Published
Apr 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-409633.1The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller hCVE-2026-409647.5Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read CVE-2026-4096510.0Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC CVE-2026-409665.9In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrCVE-2026-409678.6In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector storCVE-2026-409688.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can bCVE-2026-409695.3The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status descriptionCVE-2026-409706.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting CVE-2026-409719.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thCVE-2026-409727.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seCVE-2026-409737.0A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seCVE-2026-409749.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affecte
CVE-2026-40962: Critical severity, CVSS 9.8 | Vulnix