Critical Vulnerabilities in ffmpeg Affecting openSUSE and SUSE Systems

A series of vulnerabilities in ffmpeg-4 have been disclosed, affecting openSUSE and SUSE systems. The vulnerabilities include CVE-2026-8461, CVE-2026-12706, CVE-2026-64830, CVE-2026-64832, CVE-2026-64835, CVE-2026-66038, and CVE-2026-66039, which can lead to denial of service, arbitrary code execution, and information disclosure. The most severe, CVE-2026-64830, has a CVSS score of 8.5, indicating a high risk of exploitation. The vulnerabilities stem from issues in various decoders, including MagicYUV and VobSub. Users are advised to patch their systems immediately using the provided update instructions. The vulnerabilities were publicly disclosed between June 18 and July 24, 2026. The advisory emphasizes the importance of auditing Linux privileges to mitigate potential damage.

Key Points: • Multiple critical vulnerabilities in ffmpeg-4 affect openSUSE and SUSE systems. • CVE-2026-64830 has a CVSS score of 8.5, indicating a high risk of exploitation. • Immediate patching is recommended to prevent denial of service and arbitrary code execution.