{"id":"CVE-2026-52295","details":"Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamf_writer.c component","modified":"2026-09-03T08:05:38.356081Z","published":"2026-09-01T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52295.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988"},{"type":"WEB","url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1"},{"type":"WEB","url":"https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52295.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"0"},{"fixed":"8439e0203744a30d280668fcd086f74ed5001da1"}],"database_specific":{"source":"REFERENCES"}}],"versions":["n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev","n4.3-dev","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev","n1.3-dev","n1.2-dev","n1.1-dev","n0.12-dev","n0.11-dev","n0.8","N"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52295.json","vanir_signatures_modified":"2026-09-03T08:05:38Z","vanir_signatures":[{"signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c"},"deprecated":false,"digest":{"line_hashes":["213187939425304004657797137271459483059","166977388366547084910410557537571803444","329902299573159492122817651982775202057","184131934009068092956195143759677125704","203055119416885039057391653613598879768","227099284709818246005972368990906323559","329113515924021422644823400989514724141","77352994146092946999042776411430446326","161592234422956537053395329513982460379","324724150736635299369932042787236968479","179110089019027239240202781357788527731","218367144637358227721713956835207613208","163780106696561946764870506847775105853","124091039373588915027270083954960409798","201079958134157239152686027061272201643","336963843026090243669855826584226371657","256644058776546516912272245352949983633"],"threshold":0.9},"id":"CVE-2026-52295-2f4c54fb","signature_type":"Line"},{"source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/mov.c","function":"mov_read_iacb"},"deprecated":false,"digest":{"function_hash":"322514834074816865179724359903979620460","length":4327},"id":"CVE-2026-52295-7166821e","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-52295-b851170a","signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/mov.c"},"deprecated":false,"digest":{"line_hashes":["165958079035524414244505411491233683748","318573864323630784065874539228515079239","79698396128858926341181147044581016854","213992027193830596330221464221717830441","134108485391336427758657759050506289808","39952423092959415094190664015582996831","334166153814024706388506809557115196771"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"339505953897374290551312392816841289198","length":1861},"id":"CVE-2026-52295-c88ed65d","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c","function":"fill_codec_config"}},{"digest":{"function_hash":"61552445631594543702034701366179963285","length":1903},"id":"CVE-2026-52295-cdcd1f4e","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c","function":"ff_iamf_write_audio_frame"},"deprecated":false}]}}],"schema_version":"1.9.0"}