{"id":"CVE-2026-52297","details":"FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.","modified":"2026-09-15T08:10:59.536116Z","published":"2026-09-13T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52297.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988"},{"type":"WEB","url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1"},{"type":"WEB","url":"https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52297.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52297"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"0"},{"fixed":"d32b387f2b0a484599d4587d651891f0c63c4238"},{"fixed":"8439e0203744a30d280668fcd086f74ed5001da1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"9.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev","n4.3-dev","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev","n1.3-dev","n1.2-dev","n1.1-dev","n0.12-dev","n0.11-dev","n0.8","N"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["213187939425304004657797137271459483059","166977388366547084910410557537571803444","329902299573159492122817651982775202057","184131934009068092956195143759677125704","203055119416885039057391653613598879768","227099284709818246005972368990906323559","329113515924021422644823400989514724141","77352994146092946999042776411430446326","161592234422956537053395329513982460379","324724150736635299369932042787236968479","179110089019027239240202781357788527731","218367144637358227721713956835207613208","163780106696561946764870506847775105853","124091039373588915027270083954960409798","201079958134157239152686027061272201643","336963843026090243669855826584226371657","256644058776546516912272245352949983633"],"threshold":0.9},"id":"CVE-2026-52297-2f4c54fb","signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c"}},{"source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/mov.c","function":"mov_read_iacb"},"deprecated":false,"digest":{"function_hash":"322514834074816865179724359903979620460","length":4327},"id":"CVE-2026-52297-7166821e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/mov.c"},"deprecated":false,"digest":{"line_hashes":["165958079035524414244505411491233683748","318573864323630784065874539228515079239","79698396128858926341181147044581016854","213992027193830596330221464221717830441","134108485391336427758657759050506289808","39952423092959415094190664015582996831","334166153814024706388506809557115196771"],"threshold":0.9},"id":"CVE-2026-52297-b851170a"},{"signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238","target":{"file":"libavformat/rawutils.c"},"deprecated":false,"digest":{"line_hashes":["195688002327067465305765588221319015242","309288324102816931239308632619998175099","208198982209572275918917816535860937592","231555107084919634110330250551123341431","168010716807985158773806969924424380093","204275076296265396432751791373547480918","230743041424433407137898346131591666852","121645463046297428931382762675379161144","64606519716965107927271010747911179138","73767112427060832523002513151109600034","219167262246002076747638059747044171272"],"threshold":0.9},"id":"CVE-2026-52297-bded55e5","signature_type":"Line"},{"target":{"function":"ff_reshuffle_raw_rgb","file":"libavformat/rawutils.c"},"deprecated":false,"digest":{"function_hash":"95585342688571589449512382820310933372","length":1096},"id":"CVE-2026-52297-bfd07778","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238"},{"deprecated":false,"digest":{"length":1861,"function_hash":"339505953897374290551312392816841289198"},"id":"CVE-2026-52297-c88ed65d","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c","function":"fill_codec_config"}},{"deprecated":false,"digest":{"function_hash":"61552445631594543702034701366179963285","length":1903},"id":"CVE-2026-52297-cdcd1f4e","signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@8439e0203744a30d280668fcd086f74ed5001da1","target":{"file":"libavformat/iamf_writer.c","function":"ff_iamf_write_audio_frame"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52297.json","vanir_signatures_modified":"2026-09-15T08:10:59Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}