{"id":"CVE-2026-52295","title":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.","summary":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.","severity":"low","cvss":2.9,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-125","CWE-120"],"vendor":"FFmpeg","product":"FFmpeg","affected":["FFmpeg < 9.0"],"published":"2026-09-01","updated":"2026-09-13","sourceUpdated":"2026-09-13T22:16:59.693","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","label":"cve@mitre.org"},{"url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","label":"cve@mitre.org"},{"url":"https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-07T10:58:23.439854Z"},"epss":0.00123,"epssPercentile":0.02402,"ingestedAt":"2026-09-07T12:10:12.574Z","slug":"CVE-2026-52295","body":"## Overview\n\nFFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":16,"depthScoreParts":{"impact":16,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201736,"id":"CVE-2026-52295","ts":1789399664488,"field":"cvss","old":"6.2","new":"2.9"},{"seq":201735,"id":"CVE-2026-52295","ts":1789399664488,"field":"severity","old":"medium","new":"low"},{"seq":200466,"id":"CVE-2026-52295","ts":1789397301944,"field":"cvss","old":"2.9","new":"6.2"},{"seq":200465,"id":"CVE-2026-52295","ts":1789397301944,"field":"severity","old":"low","new":"medium"},{"seq":197649,"id":"CVE-2026-52295","ts":1789384317543,"field":"cvss","old":"6.2","new":"2.9"},{"seq":197648,"id":"CVE-2026-52295","ts":1789384317543,"field":"severity","old":"medium","new":"low"},{"seq":196181,"id":"CVE-2026-52295","ts":1789383532325,"field":"cvss","old":"2.9","new":"6.2"},{"seq":196180,"id":"CVE-2026-52295","ts":1789383532325,"field":"severity","old":"low","new":"medium"},{"seq":195110,"id":"CVE-2026-52295","ts":1789380415742,"field":"cvss","old":"6.2","new":"2.9"},{"seq":195109,"id":"CVE-2026-52295","ts":1789380415742,"field":"severity","old":"medium","new":"low"},{"seq":193897,"id":"CVE-2026-52295","ts":1789378412359,"field":"cvss","old":"2.9","new":"6.2"},{"seq":193896,"id":"CVE-2026-52295","ts":1789378412359,"field":"severity","old":"low","new":"medium"},{"seq":192684,"id":"CVE-2026-52295","ts":1789376365669,"field":"cvss","old":"6.2","new":"2.9"},{"seq":192683,"id":"CVE-2026-52295","ts":1789376365669,"field":"severity","old":"medium","new":"low"},{"seq":191471,"id":"CVE-2026-52295","ts":1789373318333,"field":"cvss","old":"2.9","new":"6.2"},{"seq":191470,"id":"CVE-2026-52295","ts":1789373318333,"field":"severity","old":"low","new":"medium"},{"seq":190256,"id":"CVE-2026-52295","ts":1789369251823,"field":"cvss","old":"6.2","new":"2.9"},{"seq":190255,"id":"CVE-2026-52295","ts":1789369251823,"field":"severity","old":"medium","new":"low"},{"seq":189043,"id":"CVE-2026-52295","ts":1789368196844,"field":"cvss","old":"2.9","new":"6.2"},{"seq":189042,"id":"CVE-2026-52295","ts":1789368196844,"field":"severity","old":"low","new":"medium"},{"seq":187826,"id":"CVE-2026-52295","ts":1789365110037,"field":"cvss","old":"6.2","new":"2.9"},{"seq":187825,"id":"CVE-2026-52295","ts":1789365110037,"field":"severity","old":"medium","new":"low"},{"seq":186613,"id":"CVE-2026-52295","ts":1789363186199,"field":"cvss","old":"2.9","new":"6.2"},{"seq":186612,"id":"CVE-2026-52295","ts":1789363186199,"field":"severity","old":"low","new":"medium"},{"seq":185399,"id":"CVE-2026-52295","ts":1789361058745,"field":"cvss","old":"6.2","new":"2.9"},{"seq":185398,"id":"CVE-2026-52295","ts":1789361058745,"field":"severity","old":"medium","new":"low"},{"seq":184186,"id":"CVE-2026-52295","ts":1789358068899,"field":"cvss","old":"2.9","new":"6.2"},{"seq":184185,"id":"CVE-2026-52295","ts":1789358068899,"field":"severity","old":"low","new":"medium"},{"seq":182437,"id":"CVE-2026-52295","ts":1789354186790,"field":"cvss","old":"6.2","new":"2.9"},{"seq":182436,"id":"CVE-2026-52295","ts":1789354186790,"field":"severity","old":"medium","new":"low"},{"seq":181230,"id":"CVE-2026-52295","ts":1789353052562,"field":"cvss","old":"2.9","new":"6.2"},{"seq":181229,"id":"CVE-2026-52295","ts":1789353052562,"field":"severity","old":"low","new":"medium"},{"seq":180023,"id":"CVE-2026-52295","ts":1789350125492,"field":"cvss","old":"6.2","new":"2.9"},{"seq":180022,"id":"CVE-2026-52295","ts":1789350125492,"field":"severity","old":"medium","new":"low"},{"seq":178816,"id":"CVE-2026-52295","ts":1789348015281,"field":"cvss","old":"2.9","new":"6.2"},{"seq":178815,"id":"CVE-2026-52295","ts":1789348015281,"field":"severity","old":"low","new":"medium"},{"seq":177609,"id":"CVE-2026-52295","ts":1789346245913,"field":"cvss","old":"6.2","new":"2.9"},{"seq":177608,"id":"CVE-2026-52295","ts":1789346245913,"field":"severity","old":"medium","new":"low"},{"seq":176402,"id":"CVE-2026-52295","ts":1789342939702,"field":"cvss","old":"2.9","new":"6.2"},{"seq":176401,"id":"CVE-2026-52295","ts":1789342939702,"field":"severity","old":"low","new":"medium"},{"seq":175854,"id":"CVE-2026-52295","ts":1789338765619,"field":"cvss","old":"6.2","new":"2.9"},{"seq":175853,"id":"CVE-2026-52295","ts":1789338765619,"field":"severity","old":"medium","new":"low"}]}