CVE-2026-52296 is a low severity (CVSS 2.9) out-of-bounds read in FFmpeg. The WMA encoder in libavcodec allocates extradata without the required padding. The record lists FFmpeg before 9.0 as affected. The steps below show how to check your version and what to change.
What's affected
- FFmpeg before 9.0, per the record.
The fix is in an upstream pull request titled "Fix various extradata padding issues", merged into the main branch on 2026-05-03 according to the project's code review page. That change touches the WMA encoder and also the MOV parsing path covered by CVE-2026-52297. I did not confirm which numbered releases carry it, so rely on release notes or your distribution's changelog.
The score is low (2.9). The attack vector is local with high complexity in the record's metrics.
How to check if you're exposed
Print the version of every FFmpeg you run:
ffmpeg -version
Do not stop at the command line tool. Many applications bundle or link FFmpeg libraries such as libavcodec and libavformat, and container images often include their own copy. Inventory those too. Distribution packages may carry a backported fix under an older version number, so read the package changelog for this CVE id.
What to do now
- Upgrade to FFmpeg 9.0 or later, or install a distribution build that lists this CVE as fixed.
- Update or rebuild applications and container images that bundle FFmpeg libraries.
- If you process media from untrusted sources, run the work in a sandbox with limited memory and no network.
- Use your dependency scanning to find where libavcodec and libavformat are pulled in transitively.
Why it matters
The record lists CWE-125, out-of-bounds read. FFmpeg's decoders and parsers read slightly past the end of some buffers for speed and expect the allocator to leave padding bytes. When code in the WMA encoder allocated its extradata without that padding, a read could go beyond the allocation.
A low score does not mean the code is safe to ignore. FFmpeg sits inside a great deal of software, so one flaw can show up in many products. The practical task is finding every copy. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this the same bug as CVE-2026-52297?
They share a fix in the same upstream pull request, but they are different code paths. This one is the WMA encoder and the other is MOV parsing.
Why does the score stay low?
The record's metrics show a local vector and high attack complexity with limited impact.
Sources
Last reviewed: 18 October 2026.
