Medium severity · published Sep 14, 2026
CVE-2026-90815
FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
FFmpeg · Ffmpeg
4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +21 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90815
code.ffmpeg.org
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1
code.ffmpeg.org
https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487
ffmpeg.org
https://ffmpeg.org/
vuldb.com
https://vuldb.com/cve/CVE-2026-90815
vuldb.com
https://vuldb.com/submit/922609
vuldb.com
https://vuldb.com/vuln/403317
More from FFmpeg
9.8
CVE-2026-75143
FFmpeg Heap Buffer Overflow via RIST Protocol Reader
9.8
CVE-2026-40962
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c
9.8
CVE-2024-35368
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c
9.8
CVE-2024-31581
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c
9.8
CVE-2024-22862
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser