openSUSE ffmpeg Important Heap Overflow Denial of Service Vuln 2026-3529

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

This update for ffmpeg-4 fixes the following issues:

Update to release 4.4.8.

* CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to

denial of service or remote code execution (bsc#1269490).

* CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead

to denial of service (bsc#1268595).

* CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead

to arbitrary code execution (bsc#1272752).

* CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to

can lead to memory corruption (bsc#1272754).

* CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can

lead to information disclosure and memory corruption (bsc#1272758).

* CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video

decoder can lead to sensitive information disclosure (bsc#1272768).

* CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead

to heap corruption...

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-3529=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-3529=1

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-3529=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-3529=1

zypper in -t patch SUSE-2026-3529=1

* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)

* libswscale5_9-debuginfo-4.4.8-150400.3.72.1

* libswresample3_9-4.4.8-150400.3.72.1

* ffmpeg-4-libavutil-devel-4.4.8-150400.3.72.1

* ffmpeg-4-4.4.8-150400.3.72.1

* libpostproc55_9-4.4.8-150400.3.72.1

* ffmpeg-4-libavdevice-devel-4.4.8-150400.3.72.1

* ffmpeg-4-libavfilter-devel-4.4.8-150400.3.72.1

* libavdevice58_13-4.4.8-150400.3.72.1

* libavfilter7_110-4.4.8-150400.3.72.1

* ffmpeg-4-debuginfo-4.4.8-150400.3.72.1

* ffmpeg-4-libswresample-devel-4.4.8-150400.3.72.1

* libavformat58_76-debuginfo-4.4.8-150400.3.72.1

* ffmpeg-4-libavcodec-devel-4.4.8-150400.3.72.1

* libavfilter7_110-debuginfo-4.4.8-150400.3.72.1

* ffmpeg-4-debugsource-4.4.8-150400.3.72.1

* ffmpeg-4-libavresample-devel-4.4.8-150400.3.72.1

* ffmpeg-4-libavformat-devel-4.4.8-150400.3.72.1

* ffmpeg-4-libpostproc-devel-4.4.8-150400.3.72.1

* libavcodec58_134-4.4.8-150400.3.72.1

* libavcodec58_134-debuginfo-4.4.8-150400.3.72.1

* libavresample4_0-4.4.8-150400.3.72.1

*

*

*

*

*

*

*

*

*

*

*

*

*

*

Get the latest Linux and open source security news straight to your inbox.