{"id":"CVE-2026-52296","details":"FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.","modified":"2026-09-15T08:11:00.127428Z","published":"2026-09-13T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52296.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988"},{"type":"WEB","url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47"},{"type":"WEB","url":"https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52296.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52296"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"0"},{"fixed":"d32b387f2b0a484599d4587d651891f0c63c4238"},{"fixed":"23227a444de4a8f7696f46660cdd044b460f7e47"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"9.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev","n4.3-dev","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev","n1.3-dev","n1.2-dev","n1.1-dev","n0.12-dev","n0.11-dev","n0.8","N"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52296.json","vanir_signatures_modified":"2026-09-15T08:11:00Z","vanir_signatures":[{"target":{"file":"libavcodec/wmaenc.c","function":"encode_init"},"deprecated":false,"digest":{"function_hash":"201557290422126632786232664707981504883","length":2008},"id":"CVE-2026-52296-b092ce39","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@23227a444de4a8f7696f46660cdd044b460f7e47"},{"signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@23227a444de4a8f7696f46660cdd044b460f7e47","target":{"file":"libavcodec/wmaenc.c"},"deprecated":false,"digest":{"line_hashes":["20204384194780040552545282478211743075","228035550850141596297616443997657186809","59395526396541357230794574302453546376","176094165595622941889204509055759672514","61142653099435255115956134989778966258","90256317056478692104367071686749552495","182430672076796361742597766710227317293","42017482687053412271648244622675009582","186196479602934838553886181419208631877","186631702722762750434676725558034536009","152115048178324445723425208109632491486"],"threshold":0.9},"id":"CVE-2026-52296-b5e2dfa9","signature_type":"Line"},{"target":{"file":"libavformat/rawutils.c"},"deprecated":false,"digest":{"line_hashes":["195688002327067465305765588221319015242","309288324102816931239308632619998175099","208198982209572275918917816535860937592","231555107084919634110330250551123341431","168010716807985158773806969924424380093","204275076296265396432751791373547480918","230743041424433407137898346131591666852","121645463046297428931382762675379161144","64606519716965107927271010747911179138","73767112427060832523002513151109600034","219167262246002076747638059747044171272"],"threshold":0.9},"id":"CVE-2026-52296-bded55e5","signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238"},{"signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238","target":{"file":"libavformat/rawutils.c","function":"ff_reshuffle_raw_rgb"},"deprecated":false,"digest":{"function_hash":"95585342688571589449512382820310933372","length":1096},"id":"CVE-2026-52296-bfd07778"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}