Veille CVE

Semaine du 15 juin au 21 juin 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « FFmpeg » ✕
  1. CVE-2026-12706 6.5 Moyenne

    Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

  2. CVE-2026-8461 8.8 Élevée

    FFmpeg · Red Hat Enterprise Linux AI 3.5 for RHEL 9 · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3

    An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.