CVE-2026-90815
FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
| CWE | CWE-125 CWE-119 |
| Vendor | n/a |
| Product | ffmpeg |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a ffmpeg
Be the first to know when new medium vulnerabilities affecting n/a ffmpeg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / FFmpeg
4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5 4.4.6 5.1.0 5.1.1 5.1.2 5.1.3 5.1.4 5.1.5 5.1.6 5.1.7 5.1.8 6.1.0 6.1.1 6.1.2 6.1.3 6.1.4 7.1.0 7.1.1 7.1.2 7.1.3 8.0.0 8.0.1
References
vuldb.com: https://vuldb.com/vuln/403317 vuldb.com: https://vuldb.com/vuln/403317/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90815 vuldb.com: https://vuldb.com/submit/922609 code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487 code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1 ffmpeg.org: https://ffmpeg.org/
Credits
🔍 Kery Qi (VulDB User)