CVE-2026-90815: FFmpeg Buffer Overflow Vulnerability

CVE-2026-90815 Overview

A vulnerability in FFmpeg affects the setup_3x3 function within libavfilter/vf_convolution.c, part of the Convolution Filter component. The flaw results in an out-of-bounds read [CWE-119] when processing crafted input. The issue affects FFmpeg versions up to 4.4.6, 5.1.8, 6.1.4, 7.1.3, and 8.0.1. The vulnerability requires user interaction to trigger but can be initiated remotely through malicious media content. Public disclosure of the exploit has occurred, increasing the risk of opportunistic use against media processing pipelines.

Critical Impact
An out-of-bounds read in the FFmpeg Convolution Filter can expose adjacent memory contents or cause process instability when processing attacker-supplied media.

Affected Products

FFmpeg versions up to and including 4.4.6
FFmpeg versions 5.1.8, 6.1.4, 7.1.3, and 8.0.1
Applications and services embedding vulnerable FFmpeg libraries for media processing

Discovery Timeline

2026-09-14 - CVE-2026-90815 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90815

Vulnerability Analysis

The vulnerability resides in the setup_3x3 function inside libavfilter/vf_convolution.c. This function prepares pixel neighborhoods for 3x3 convolution kernel operations used in FFmpeg's video filter pipeline. Insufficient boundary validation allows read access beyond the allocated pixel buffer during setup. The result is an out-of-bounds read [CWE-119] that may leak adjacent memory contents into filter output or cause the FFmpeg process to crash.

An attacker triggers the flaw by supplying crafted media content processed through the Convolution Filter. Because FFmpeg is widely embedded in transcoding services, media players, and content ingestion pipelines, the vulnerable code path can be reached through common workflows. User interaction is required, typically opening or processing the malicious media file.

Root Cause

The root cause is inadequate bounds checking in setup_3x3 when computing pixel access offsets. The function reads neighboring pixel values without confirming that all sample coordinates fall within the source buffer. Certain frame dimensions or edge conditions cause the function to dereference memory outside the intended plane, producing the out-of-bounds read.

Attack Vector

Exploitation occurs over a network attack vector when a victim processes attacker-controlled media through the Convolution Filter. Delivery methods include hosted video files, streaming payloads, or media uploaded to services that invoke FFmpeg filters server-side. See the FFmpeg Issue Tracker Entry and the FFmpeg Commit Reference for technical details on the vulnerable code path and its fix.

Detection Methods for CVE-2026-90815

Indicators of Compromise

Unexpected FFmpeg process crashes or segmentation faults during video filter operations
Media processing jobs producing corrupted output frames when the Convolution Filter is applied
Unusual memory access patterns in libavfilter reported by memory sanitizers or crash dumps

Detection Strategies

Inventory all systems running FFmpeg and identify installed versions against the fixed release list
Monitor build systems, containers, and third-party applications that bundle vulnerable FFmpeg shared libraries
Review media processing telemetry for anomalous crashes correlated with untrusted input sources

Monitoring Recommendations

Log all FFmpeg invocations that use -vf convolution or related filter chains and alert on unexpected terminations
Enable core dump collection on media processing hosts to capture evidence of exploitation attempts
Track EPSS scoring (currently 0.242%, 15.698 percentile) for shifts in exploitation likelihood using data from the VulDB CVE-2026-90815 entry

How to Mitigate CVE-2026-90815

Immediate Actions Required

Upgrade FFmpeg to a patched release: 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, or 9.0
Rebuild and redeploy any downstream applications or containers that statically link or bundle FFmpeg libraries
Restrict processing of untrusted media through filter chains that invoke the Convolution Filter until patching is complete

Patch Information

The upstream fix is tracked as patch 8970658472/e24b9820b4. Refer to the FFmpeg Commit Reference for the exact code change. Distribution maintainers should backport the patch to supported LTS branches and validate rebuilt binaries before deployment.

Workarounds

Disable the Convolution Filter in FFmpeg-based pipelines where it is not required
Sandbox media processing workloads with restricted memory access and non-privileged service accounts
Validate media file metadata and reject unexpected frame geometries before invoking filter chains

bash

# Verify installed FFmpeg version against fixed releases
ffmpeg -version | head -n 1

# Example: pin patched version in a container build
# Debian/Ubuntu
apt-get install -y ffmpeg=7:8.0.2-*