{"id":"CVE-2026-96611","revision":"99db8a6c1f554a8089411bc59e80f540","records":[{"revision":"99db8a6c1f554a8089411bc59e80f540","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96611","aliases":[],"title":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX…","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks.","state":0,"publishedAt":"2026-09-23T14:18:54.929+00:00","modifiedAt":"2026-09-26T22:51:22.006+00:00","affected":[{"ecosystem":"Vendor product","name":"FFmpeg","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"libavformat\"\n                    ],\n                    \"product\": \"FFmpeg\",\n                    \"programFiles\": [\n                        \"libavformat/mov.c\"\n                    ],\n                    \"repo\": \"https://github.com/FFmpeg/FFmpeg\",\n                    \"vendor\": \"FFmpeg\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"9.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","score":6.9,"severity":"MEDIUM"}],"references":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96611","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96611","identifiers":["CVE-2026-96611"]},"retained":false,"historicalAffected":[]}],"coverage":[]}