CVE-2026-40962

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2026-04-16

Last modified

2026-04-16

Weaknesses

CWE-190

Affected products

• Ffmpeg (Ffmpeg)

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348