Back Linuxsecurity

Ubuntu 26.04 Kdenlive Important Command Execution Risk USN-8856

Linuxsecurity •LinuxSecurity Advisories • September 30, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

Kdenlive, MLT could be made to run programs as your login if it opened a specially crafted file. Software Description: - kdenlive: KDE Non-Linear Video Editor - mlt: Multimedia Framework Details: It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties.

Kdenlive, MLT could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- kdenlive: KDE Non-Linear Video Editor

- mlt: Multimedia Framework

It was discovered that Kdenlive allowed dangerous proxy parameters when

processing attacker-controlled project files. An attacker could use this to

execute arbitrary commands via the MLT framework's ante/post consumer

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS kdenlive 4:25.12.3-0ubuntu1.1 libmlt7 7.36.1-1ubuntu3.1 melt 7.36.1-1ubuntu3.1 In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8856-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kdenlive and MLT Vulnerability Allows Command Execution via Malicious Files A vulnerability in Kdenlive and the MLT framework could allow attackers to execute arbitrary commands on an user's system by opening specially crafted project files. This flaw arises from the handling of dangerous proxy parameters within Kdenlive, a KDE Non-Linear Video Editor, and the MLT Multimedia Framework. Users of Ubuntu 26.04 LTS are particularly affected, with specific package versions identified for updating. A standard system update is recommended to mitigate the risk. The vulnerability has been assigned the identifier USN-8856-1, and users are advised to apply the necessary updates to reduce their security exposure. No has been reported at this time. 2 sources 30

Extracted Entities

Ubuntu 26.04 Kdenlive Important Command Execution Risk USN-8856

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)