CVE-2026-6385

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6385", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-04-15T19:11:41.901Z", "datePublished": "2026-04-15T19:18:39.354Z", "dateUpdated": "2026-04-15T20:01:15.671Z"}, "containers": {"cna": {"title": "Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}], "affected": [{"vendor": "Red Hat", "product": "Lightspeed Core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "lightspeed-core/rag-tool-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:lightspeed_core"]}, {"vendor": "Red Hat", "product": "Red Hat AI Inference Server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhaiis-preview/vllm-cuda-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ai_inference_server:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ffmpeg", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-cuda-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai3/bootc-rocm-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_ai"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-6385", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "name": "RHBZ#2458764", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-04-15T19:11:47.803Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound", "workarounds": [{"lang": "en", "value": "To mitigate this issue, avoid processing untrusted MPEG-PS/VOB media files with FFmpeg. If FFmpeg is used in automated media processing services, implement strict input validation and isolation to prevent the ingestion of malicious files from untrusted sources. For end-user applications, refrain from opening or playing untrusted media files."}], "timeline": [{"lang": "en", "time": "2026-04-15T19:11:15.167Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-15T19:11:47.803Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Quang Luong (Calif.io in collaboration with OpenAI Codex) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-04-15T19:18:39.354Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T20:00:53.669051Z", "id": "CVE-2026-6385", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:01:15.671Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6385", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T20:00:53.669051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:01:09.811Z"}}], "cna": {"title": "Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser", "credits": [{"lang": "en", "value": "Red Hat would like to thank Quang Luong (Calif.io in collaboration with OpenAI Codex) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:lightspeed_core"], "vendor": "Red Hat", "product": "Lightspeed Core", "packageName": "lightspeed-core/rag-tool-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ai_inference_server:3"], "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "packageName": "rhaiis-preview/vllm-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "ffmpeg", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-rocm-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-15T19:11:15.167Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-15T19:11:47.803Z", "value": "Made public."}], "datePublic": "2026-04-15T19:11:47.803Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-6385", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "name": "RHBZ#2458764", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, avoid processing untrusted MPEG-PS/VOB media files with FFmpeg. If FFmpeg is used in automated media processing services, implement strict input validation and isolation to prevent the ingestion of malicious files from untrusted sources. For end-user applications, refrain from opening or playing untrusted media files."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-04-15T19:18:39.354Z"}, "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"}}, "cveMetadata": {"cveId": "CVE-2026-6385", "state": "PUBLISHED", "dateUpdated": "2026-04-15T20:01:15.671Z", "dateReserved": "2026-04-15T19:11:41.901Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-04-15T19:18:39.354Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:lightspeed_core"], "defaultStatus": "affected", "packageName": "lightspeed-core/rag-tool-rhel9", "product": "Lightspeed Core", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ai_inference_server:3"], "defaultStatus": "affected", "packageName": "rhaiis-preview/vllm-cuda-rhel9", "product": "Red Hat AI Inference Server", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "ffmpeg", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-rocm-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en FFmpeg. Un atacante remoto podr\u00eda explotar esta vulnerabilidad al proporcionar un archivo multimedia MPEG-PS/VOB especialmente dise\u00f1ado que contiene una secuencia de subt\u00edtulos de DVD maliciosa. Esta vulnerabilidad es causada por un desbordamiento de entero con signo en las comprobaciones de l\u00edmites de reensamblaje de fragmentos del analizador de subt\u00edtulos de DVD, lo que lleva a una escritura fuera de l\u00edmites en el heap. La explotaci\u00f3n exitosa puede resultar en una denegaci\u00f3n de servicio (DoS) debido a un fallo de la aplicaci\u00f3n, y potencialmente conducir a la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2026-6385", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6385", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T20:00:53.669051Z", "version": "2.0.3"}}]}, "published": "2026-04-15T20:16:44.230", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-6385"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458764"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Quang Luong (Calif.io in collaboration with OpenAI Codex) for reporting this issue.", "bugzilla": {"description": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "id": "2458764", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458764"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid processing untrusted MPEG-PS/VOB media files with FFmpeg. If FFmpeg is used in automated media processing services, implement strict input validation and isolation to prevent the ingestion of malicious files from untrusted sources. For end-user applications, refrain from opening or playing untrusted media files."}, "name": "CVE-2026-6385", "package_state": [{"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Fix deferred", "package_name": "lightspeed-core/rag-tool-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Fix deferred", "package_name": "rhaiis-preview/vllm-cuda-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "ffmpeg", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-aws-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gcp-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-04-15T19:11:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6385\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6385"], "statement": "This Critical vulnerability in FFmpeg's DVD subtitle parser allows a heap out-of-bounds write due to a signed integer overflow. Processing a specially crafted MPEG-PS/VOB media file, either locally or via remote URL ingest, can lead to a denial of service or potentially arbitrary code execution in applications utilizing FFmpeg's vulnerable APIs.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ffmpeg", "vendor": "ffmpeg"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "Red Hat AI Inference Server", "source": "cna", "vendor": "Red Hat"}, "product": "ai_inference_server", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux_ai", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Lightspeed Core", "source": "cna", "vendor": "Red Hat"}, "product": "lightspeed_core", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat OpenShift AI (RHOAI)", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_ai", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-16T02:20:53.496562+00:00", "value": {"mitigation_remediation": ["Update FFmpeg to a version that contains the overflow fix once it becomes available.", "If an update is not immediately possible, run media-processing components in a sandbox and enforce strict input validation so that only trusted files are processed.", "Avoid opening or playing untrusted MPEG-PS/VOB files in end-user applications, and limit the privileges of the FFmpeg process to reduce the impact of a crash or exploit."], "summary": {"action": "Patch", "impact": "Denial of Service and potential code execution"}, "threat_synthesis": {"affected_systems": "Products impacted are Red\u202fHat Lightspeed\u202fCore, Red\u202fHat AI Inference Server, Red\u202fHat Enterprise\u202fLinux\u202fAI\u202f3, and Red\u202fHat OpenShift\u202fAI. All installations that include FFmpeg are potentially vulnerable until a patch is applied; version specifics are not enumerated in the CNA entry.", "description_and_impact": "The vulnerability resides in FFmpeg's DVD subtitle parser. A specially crafted MPEG-PS/VOB file triggers a signed integer overflow during fragment reassembly, resulting in a heap out-of-bounds write. Consequences can include application crashes (Denial of Service) and, in worst cases, arbitrary code execution. The weakness is a numeric overflow (CWE-190).", "risk_and_exploitability": "The CVSS score is 6.5, indicating moderate severity. Exploitation requires delivery of a crafted media file to a system running FFmpeg, typically through a media-processing service or by a user opening a malicious file. The attack is remote and only needs the victim to process the file. The fact that no exploitation probability metric is published does not reduce the risk; a successful exploitation can lead to a denial of service or, in the most severe scenario, arbitrary code execution."}}}}, "created": "2026-04-16T02:30:21.681903+00:00", "updated": "2026-04-16T09:12:13.479513+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg", "redhat", "redhat$PRODUCT$ai_inference_server", "redhat$PRODUCT$enterprise_linux_ai", "redhat$PRODUCT$lightspeed_core", "redhat$PRODUCT$openshift_ai"]}