CVE-2026-40962 is an integer overflow in FFmpeg, scored CVSS 4.9. A flaw in libavformat/mov.c handling of Common Encryption subsample data can lead to an out of bounds write. FFmpeg 8.1 fixes it. Update, and be careful with untrusted media. Be careful with untrusted media files.
What's affected
- Affected: FFmpeg before 8.1
- Fixed: 8.1
The record names the file libavformat/mov.c and the CENC (Common Encryption) subsample data. The CVSS vector is local with high complexity. The FFmpeg code review page used an anti bot challenge when I fetched it, so I rely on the record for details.
How to check if you're exposed
Check your version:
ffmpeg -version | head -1
Check applications that bundle FFmpeg libraries too, such as media servers, thumbnailers and transcoding workers. Container images often carry their own copy:
docker run --rm IMAGE ffmpeg -version | head -1
Distributions often backport fixes, so check your distribution tracker for the package version that includes the patch.
What to do now
- Update FFmpeg to 8.1 or a distribution package with the fix.
- Rebuild images and services that bundle FFmpeg.
- Run media processing in a sandbox or container with low privileges.
- Do not process files from unknown sources on hosts that hold secrets.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. Subsample sizes from a media file feed a calculation, and an overflow produces a buffer smaller than the data placed in it. The result is an out of bounds write.
The score is medium, since the vector is local with high complexity. Media libraries sit behind upload features, preview generators and import tools, which is where a local attack vector becomes a remote one in practice. The record does not flag exploitation in the wild.
Quick check
Why does a local vector still matter?
If a service opens files that users upload, a crafted file gets in without local access to the host.
Sources
Last reviewed: 19 October 2026.
