{"id":"CVE-2026-96611","title":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c","summary":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-190"],"vendor":"FFmpeg","product":"FFmpeg","affected":["FFmpeg < 9.0"],"published":"2026-09-23","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:00:46.893","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","label":"cve@mitre.org"},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455","label":"cve@mitre.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96611.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96611"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539442"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96611"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00115,"epssPercentile":0.01355,"scores":{"nvd":6.9,"vendor":6.5},"ingestedAt":"2026-09-23T14:25:29.807Z","slug":"CVE-2026-96611","body":"## Overview\n\nFFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96611.json)","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}