USN-8915-1: Eight FFmpeg flaws, one with arbitrary code execution risk

Ubuntu published security advisory USN-8915-1 on 12 October 2026, addressing eight vulnerabilities in the ffmpeg package across all supported LTS releases: 26.04, 24.04, 22.04, 20.04, 18.04 and 16.04. The advisory affects operators running servers for transcoding, streaming or video processing via command line, including those behind media management panels or CI pipelines that process user-uploaded files.

The most serious flaw is CVE-2026-30754, with CVSS 3.1 score of 8.8. This is a memory corruption vulnerability present in FFmpeg versions before 8.1, occurring during RTP encoding. Specifically, in the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (-3) is passed to memcpy when transmitting H.264/HEVC streams over RTP using a crafted input file; the issue was detected using AddressSanitizer. According to the Ubuntu advisory, the vulnerability affects any workflow transmitting attacker-controlled media through FFmpeg's RTP muxer, including transcoding pipelines and media servers. The upstream fix arrived with FFmpeg version 8.1.

The other seven CVEs covered by the advisory are mostly denial of service issues linked to improper handling of arithmetic or memory operations (CVE-2026-38344, CVE-2026-38346, CVE-2026-38347, CVE-2026-38348, CVE-2026-38349, CVE-2026-38350), plus a sensitive information leak affecting Ubuntu 26.04 LTS only (CVE-2026-75147). The distribution of the flaws is uneven: some affect only older versions from 16.04 to 24.04, others only 26.04.

Who needs to act and how

For 26.04 LTS the corrected package is ffmpeg 7:8.0.1-3ubuntu2+esm5. For other releases the versions vary (7:6.1.1-3ubuntu5+esm15 on 24.04, 7:4.4.2-0ubuntu0.22.04.1+esm17 on 22.04, and so on down to 16.04). A sudo apt update && sudo apt upgrade updates ffmpeg and related libraries (libavcodec, libavfilter, libavformat in their respective variants).

One important caveat: for all releases from 16.04 to 24.04 LTS the fix is available only via Ubuntu Pro through ESM Apps, as these packages are now out of standard support. Operators running servers on those versions without a Pro subscription remain exposed until they upgrade to a release still in standard support or activate ESM coverage.