Vulnpedia
← All CVEs

CVE-2026-64835

HIGH 8.7 ALL-YEARS

Published 2026-07-22 · Last modified 2026-07-28 · VulnCheck · NVD: Analyzed

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 42nd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

8.7CVSS 4.0 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Ffmpeg

Products Ffmpeg

Weakness (CWE)

  • CWE-787: Out-of-bounds Write

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 1447 vendor product statements; 1415 omitted. Read the full vendor advisory.

  • ffmpeg-0:6.1.6-3.el9ai.src as a component of Red Hat Enterprise Linux AI 3.0 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libavcodec-free-rhai-debuginfo-0:6.1.6-9.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.0 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libavfilter-free-rhai-devel-0:6.1.6-9.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.0 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64le

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libpostproc-free-rhai-0:6.1.6-9.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.0 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64le

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libswscale-free-rhai-debuginfo-0:6.1.6-9.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.0 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64le

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libavdevice-free-rhai-devel-0:6.1.6-3.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.2 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libswresample-free-rhai-debuginfo-0:6.1.6-3.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.2 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libavdevice-free-rhai-debuginfo-0:6.1.6-3.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.3 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x

    • vendor fix: Backporting CVE Fixes from upstream ffmpeg-6.1.6-3.el9ai Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • libswresample-free-rhai-0:6.1.6-3.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.3 for RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x

    • vendor fix: Backporting CVE Fixes from upstream ffmpeg-6.1.6-3.el9ai Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:07476932142451399c908fa867c37e481f50ef9381a06b7cd94bc8a5d9870c7b_amd64 as a component of Red Hat OpenShift AI 3.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-rocm-rhel9@sha256%3A07476932142451399c908fa867c37e481f50ef9381a06b7cd94bc8a5d9870c7b?arch=amd64&repository_url=registry.redhat.io/rhai/base-image-rocm-rhel9&tag=1790703506

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:74459 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhai/base-image-tpu-rhel9@sha256:2df8527a738c3183d24f72f33b9460e9f0a173727486b69a718551dd7afc849f_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-tpu-rhel9@sha256%3A2df8527a738c3183d24f72f33b9460e9f0a173727486b69a718551dd7afc849f?arch=amd64&repository_url=registry.redhat.io/rhai/base-image-tpu-rhel9&tag=1788197492

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:71394 Vendor guidance
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/model-opt-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/model-opt-cuda-rhel9?repository_url=registry.redhat.io/rhaii/model-opt-cuda-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9?repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9?repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-tpu-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhai/base-image-rocm-7.0-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/base-image-rocm-7.0-rhel9?repository_url=registry.redhat.io/rhai/base-image-rocm-7.0-rhel9

    • none available: Affected
    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:6a3e7d0dcb52e8ea9e4f73344ff216b880dadf61f03a0551b7e97fe383098368_arm64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-built-in-detector-rhel9@sha256%3A6a3e7d0dcb52e8ea9e4f73344ff216b880dadf61f03a0551b7e97fe383098368?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-built-in-detector-rhel9&tag=1789573032

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-mlserver-rhel9@sha256:283785367ad6ebfca2d7cd516e18b6588b975802b01a02e6e18f137466e30ba0_arm64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mlserver-rhel9@sha256%3A283785367ad6ebfca2d7cd516e18b6588b975802b01a02e6e18f137466e30ba0?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mlserver-rhel9&tag=1789121365

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9@sha256:c27da769f64622cc443883d6f5d9076136ae31fd95a3f077ef00f7fc50b1632d_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-service-operator-rhel9@sha256%3Ac27da769f64622cc443883d6f5d9076136ae31fd95a3f077ef00f7fc50b1632d?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9&tag=1790136613

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:5fa73ac9806750dba8388a9b3087f44d3cc82f015e620defd84f2adfe0301d50_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-operator-controller-rhel9@sha256%3A5fa73ac9806750dba8388a9b3087f44d3cc82f015e620defd84f2adfe0301d50?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9&tag=1787002057

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:47307461df1fa8a20ef41230b90e2d3293a9884d37394d2328150949e6ee1c75_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kube-auth-proxy-rhel9@sha256%3A47307461df1fa8a20ef41230b90e2d3293a9884d37394d2328150949e6ee1c75?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9&tag=1787102977

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:5ce4b827b855448b33742e770b3acf76d3172c28c3eceb94b171dd45d33f2d1a_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-launcher-rhel9@sha256%3A5ce4b827b855448b33742e770b3acf76d3172c28c3eceb94b171dd45d33f2d1a?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9&tag=1787331889

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:37df8c9bbb5dd8460ad7b6f6a37b6a17a45b90151e5831462acd4b85d407fcae_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-controller-rhel9@sha256%3A37df8c9bbb5dd8460ad7b6f6a37b6a17a45b90151e5831462acd4b85d407fcae?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-controller-rhel9&tag=1790958159

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:992b4a099bc21bdf1e7f12173cf1d4939f19a739efaad905bb3c9802323cdb47_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3A992b4a099bc21bdf1e7f12173cf1d4939f19a739efaad905bb3c9802323cdb47?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1791828837

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9@sha256:677c628aff6b4891251647bc9b699695d33ce6af671f15afbcda23b5c4401563_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-service-operator-rhel9@sha256%3A677c628aff6b4891251647bc9b699695d33ce6af671f15afbcda23b5c4401563?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9&tag=1791292352

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00
  • rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9

    Red Hat · CVE-2026-64835 · Updated 2026-10-19T11:24:55+00:00

Known Affected Software Configurations

VendorProductVersion range
FfmpegFfmpeg≥ 4.4 and ≤ 8.1.2

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 8.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS