CVE-2026-8158

MediumCVSS 5.3/10Last modified Sep 3, 2026

Description

The Signed Video Framework contained a buffer overflow issue

which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Axis Communications AB	Signed Video Framework	< 2.3.5
Axis Communications AB	Signed media verifier	< 1.0.2
Axis Communications AB	Axis File Player	< 3.1.9.0

References

https://www.axis.com/dam/public/6c/f3/ac/cve-2026-8158pdf-en-US-543645.pdf

Timeline

Published: Aug 11, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-815818.8Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the p CVE-2026-815835.4The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite in CVE-2026-815848.1An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) be CVE-2026-81597.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filen CVE-2026-81617.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request wit CVE-2026-81627.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request wit CVE-2026-816238.8IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due CVE-2026-816247.5Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. CVE-2026-816258.8A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a CVE-2026-816268.6IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated u CVE-2026-816278.2A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the opti CVE-2026-81638.8The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statement