CVE-2026-52297 is a low severity (CVSS 2.9) out-of-bounds read in FFmpeg. The MOV parsing function mov_read_iacb in libavformat reads extradata that is insufficiently padded. The record lists FFmpeg before 9.0 as affected. The steps below show how to check your version and what to change.
What's affected
- FFmpeg before 9.0, per the record.
The fix comes from the upstream pull request "Fix various extradata padding issues", merged into the main branch on 2026-05-03 according to the project's review page. It also covers the WMA encoder issue, CVE-2026-52296. I did not confirm which numbered releases include it, so check release notes or your distribution's changelog.
The score is low (2.9), with a local vector and high complexity in the record's metrics.
How to check if you're exposed
Print the version of every FFmpeg you run:
ffmpeg -version
Do not stop at the command line tool. Many applications bundle or link FFmpeg libraries such as libavcodec and libavformat, and container images often include their own copy. Inventory those too. Distribution packages may carry a backported fix under an older version number, so read the package changelog for this CVE id.
This one is reached when FFmpeg parses MP4 or MOV family files, so it matters most for services that accept uploaded video.
What to do now
- Upgrade to FFmpeg 9.0 or later, or install a distribution build that lists this CVE as fixed.
- Update or rebuild applications and container images that bundle FFmpeg libraries.
- If you process media from untrusted sources, run the work in a sandbox with limited memory and no network.
- Use your dependency scanning to find where libavcodec and libavformat are pulled in transitively.
Why it matters
The record lists CWE-125, out-of-bounds read. The MOV demuxer function mov_read_iacb in libavformat/mov.c stores data in a buffer that other FFmpeg code expects to have extra padding bytes after it. Without the padding, a read can run past the end of the allocation.
The impact in the record is limited, but media parsing is a common way for untrusted input to reach native code. Services that transcode user uploads should treat every parser fix as worth taking. The record does not mark this CVE as known exploited.
If you accept uploaded video, consider running transcoding in a short-lived container with tight memory limits. That contains the effect of any future parser bug, whatever its score.
Quick check
Which files reach this code?
The function is in the MOV parser, so MP4 and related container files that contain the relevant box are the path.
Does updating the ffmpeg command fix other programs?
Not always. Programs that bundle their own libavformat need their own update.
Sources
Last reviewed: 18 October 2026.
