CVE-2026-30997

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30997
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f Exploit Mitigation Third Party Advisory
https://github.com/FFmpeg/FFmpeg Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

23 Apr 2026, 20:12

Type Values Removed Values Added
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
References () https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f - () https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f - Exploit, Mitigation, Third Party Advisory
References () https://github.com/FFmpeg/FFmpeg - () https://github.com/FFmpeg/FFmpeg - Product
First Time Ffmpeg
Ffmpeg ffmpeg

13 Apr 2026, 20:16

Type Values Removed Values Added
CWE CWE-125
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

13 Apr 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-13 15:17

Updated : 2026-04-23 20:12

NVD link : CVE-2026-30997

Mitre link : CVE-2026-30997

CVE.ORG link : CVE-2026-30997

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-125

Out-of-bounds Read