FFmpeg Vulnerabilities Expose Ubuntu Systems to Remote Attacks
Critical flaws in FFmpeg subtitle and video handling may allow denial of service or remote code execution on Ubuntu systems.
TL;DR
- Two high-severity vulnerabilities found in FFmpeg affect Ubuntu 22.04 and 24.04 LTS.
- Issues stem from improper handling of subtitle data and video files.
- Attackers may trigger denial of service or execute arbitrary code remotely.
- Patches are available; immediate system updates recommended.
- Organizations using FFmpeg in web applications should audit their exposure.
Ubuntu has released a security update addressing two critical vulnerabilities in FFmpeg, a widely used multimedia framework. These flaws, discovered by researcher Adrian Junge, could allow attackers to crash services or execute malicious code on vulnerable systems.
The vulnerabilities affect how FFmpeg processes certain subtitle data and video files. Given FFmpeg's widespread integration into media processing pipelines and web applications, these issues pose a significant risk to organizations running Ubuntu-based servers.
Vulnerability Details
- CVE-2026-70628 relates to improper handling of subtitle data in FFmpeg.
- CVE-2026-70632 affects video file processing and is limited to Ubuntu 22.04 and 24.04 LTS.
- Both vulnerabilities can lead to denial of service or arbitrary code execution.
- Exploitation requires processing maliciously crafted media files.
Impact and Mitigation
- Systems running Ubuntu 22.04 and 24.04 LTS are at risk.
- Web applications using FFmpeg to process user-uploaded content are particularly vulnerable.
- Ubuntu has released patched versions of FFmpeg for affected releases.
- Administrators should update their systems immediately using standard package managers.
- Developers should validate and sanitize all media inputs before processing.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.