Ubuntu Patches Eight FFmpeg Flaws Including a Possible Arbitrary Code Execution Bug
Canonical published security notice USN-8915-1 on 12 October 2026, correcting eight separate vulnerabilities in FFmpeg, the multimedia framework used for transcoding, streaming and playback across most Linux estates. The most serious of the set, CVE-2026-30754, stems from incorrect handling of certain memory operations and could allow an attacker to execute arbitrary code; it affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS and 24.04 LTS, but not 26.04 LTS. A second memory-handling flaw, CVE-2026-75147, affects only Ubuntu 26.04 LTS and could be used to leak sensitive information. The remaining six issues — CVE-2026-38344, CVE-2026-38346, CVE-2026-38347, CVE-2026-38348, CVE-2026-38349 and CVE-2026-38350 — are memory and arithmetic handling errors that could be used to cause a denial of service, with CVE-2026-38347 and CVE-2026-38350 limited to the 16.04 through 24.04 releases. Fixes cover the ffmpeg binary package as well as the shared libraries that carry most of the risk, including libavcodec, libavformat and libavfilter and their -extra variants.
The notice does not publish exploitation details, proof-of-concept code or CVSS scores for any of the eight issues, and no attack chain has been described by the vendor. What the advisory does establish is the class of defect and the exposure profile: memory operations handled incorrectly in the decode and demux paths, and arithmetic operations that are not correctly bounded. Those code paths exist to parse untrusted input, so the realistic trigger for all eight issues is a malformed or deliberately crafted media file or stream reaching a process that links the affected libraries. Two of the findings are credited to external researchers, with CVE-2026-30754 reported by Momoko Shiraishi and CVE-2026-75147 reported by Joshua Rogers. Fixed package versions are 7:8.0.1-3ubuntu2+esm5 for 26.04 LTS resolute, 7:6.1.1-3ubuntu5+esm15 for 24.04 LTS noble, 7:4.4.2-0ubuntu0.22.04.1+esm17 for 22.04 LTS jammy, 7:4.2.7-0ubuntu0.1+esm18 for 20.04 LTS focal and 7:3.4.11-0ubuntu0.1+esm16 for 18.04 LTS bionic, all delivered through Ubuntu Pro ESM Apps, with the notice stating that a community fix might become publicly available in the future.
The practical significance of an FFmpeg advisory is the sheer breadth of what quietly depends on it. The libav* libraries sit underneath video conferencing backends, thumbnail generators, user-upload processing pipelines, CCTV and media servers, and ordinary desktop players, which means a single unpatched shared library can be reachable from an internet-facing upload form on one host and from a user double-clicking a downloaded file on another. Because every supported LTS line from 16.04 to 26.04 is named, estates that mix release generations are likely to have affected packages in more than one place, including inside container images that bundle their own ffmpeg build rather than consuming the host package. The delivery mechanism is also worth noting: these fixes arrive via Ubuntu Pro ESM Apps, so systems without Pro coverage on the older releases will not pick them up through a routine update cycle. On current exploitation status, the evidence is modest — FIRST EPSS places CVE-2026-30754, CVE-2026-38344, CVE-2026-38346, CVE-2026-38347, CVE-2026-38348, CVE-2026-38349 and CVE-2026-38350 at a 0.5 percent probability of exploitation in the next 30 days, and CVE-2026-75147 at 0.1 percent. None of the eight appears in the CISA Known Exploited Vulnerabilities catalogue, and the vendor reports no exploitation in the wild. This is a scheduled maintenance item with a wide blast radius rather than an incident in progress.
Attack Surface
Endpoint, Server OS, Endpoint OS
Tactics
Execution, Impact, Collection
Techniques
- T1203 – Exploitation for Client Execution
- T1499.004 – Application or System Exploitation
- T1005 – Data from Local System
SuperPRO's Threat Countermeasures Procedures
- On Ubuntu 26.04 LTS resolute, upgrade ffmpeg, libavcodec62, libavcodec-extra62, libavfilter11, libavfilter-extra11, libavformat62 and libavformat-extra62 to 7:8.0.1-3ubuntu2+esm5, which closes the CVE-2026-75147 information leak affecting this release only.
- On Ubuntu 24.04 LTS noble, upgrade ffmpeg, libavcodec60, libavcodec-extra60, libavfilter9, libavfilter-extra9, libavformat60 and libavformat-extra60 to 7:6.1.1-3ubuntu5+esm15 to remediate CVE-2026-30754 and the seven other issues in USN-8915-1.
- On Ubuntu 22.04 LTS jammy upgrade the ffmpeg and libav* packages to 7:4.4.2-0ubuntu0.22.04.1+esm17, and on Ubuntu 20.04 LTS focal to 7:4.2.7-0ubuntu0.1+esm18; on Ubuntu 18.04 LTS bionic the fixed version is 7:3.4.11-0ubuntu0.1+esm16.
- These builds ship through Ubuntu Pro ESM Apps, so attach and enable the service on affected hosts with 'pro attach <token>' followed by 'pro enable esm-apps' before running 'apt update && apt install –only-upgrade ffmpeg libavcodec* libavformat* libavfilter*', otherwise the fixed versions will not be offered.
- Inventory every affected host and image with 'dpkg -l | grep -E "^ii +(ffmpeg|libav(codec|format|filter))"' and compare the output against the fixed versions above; extend the same check into container images, since many bundle a private ffmpeg build that the host package upgrade will not touch.
- Restart long-running services that keep libavcodec and libavformat mapped after the upgrade – media transcoders, thumbnailing workers, streaming daemons – identifying them with 'needrestart -r l' or 'lsof +c 0 | grep -E "libav(codec|format)"', as the old vulnerable library stays resident until the process is recycled.
- Confine media processing workers that accept user-supplied files by running ffmpeg under a dedicated systemd unit with NoNewPrivileges=yes, PrivateTmp=yes, ProtectSystem=strict and MemoryDenyWriteExecute=yes, limiting the effect of a successful CVE-2026-30754 style memory corruption on upload pipelines.
