CVE-2026-6385
Full vulnerability record from the local CVENow database.
Description
A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-04-15 20:16:44.230000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6385",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T20:16:44.230",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."
},
{
"lang": "es",
"value": "Se encontró una falla en FFmpeg. Un atacante remoto podría explotar esta vulnerabilidad al proporcionar un archivo multimedia MPEG-PS/VOB especialmente diseñado que contiene una secuencia de subtítulos de DVD maliciosa. Esta vulnerabilidad es causada por un desbordamiento de entero con signo en las comprobaciones de límites de reensamblaje de fragmentos del analizador de subtítulos de DVD, lo que lleva a una escritura fuera de límites en el heap. La explotación exitosa puede resultar en una denegación de servicio (DoS) debido a un fallo de la aplicación, y potencialmente conducir a la ejecución de código arbitrario."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Lightspeed Core",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "lightspeed-core/rag-tool-rhel9",
"cpes": [
"cpe:/a:redhat:lightspeed_core"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis-preview/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ffmpeg",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T20:00:53.669051Z",
"id": "CVE-2026-6385",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6385",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458764",
"source": "[email protected]"
}
]
}