CVE-2026-90815: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-90815 is an out-of-bounds read vulnerability in FFmpeg's Convolution Filter component, specifically in the setup_3x3 function within libavfilter/vf_convolution.c. It affects FFmpeg versions up to 4.4.6, 5.1.8, 6.1.4, 7.1.3, and 8.0.1 across multiple release branches. The vulnerability was published on September 14, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low), though the exploit has been publicly disclosed (Feedly, VulDB).

The root cause is improper restriction of memory buffer operations (CWE-119) leading to an out-of-bounds read (CWE-125) in the setup_3x3 function of libavfilter/vf_convolution.c, which handles 3x3 convolution kernel setup for video filtering. An attacker can exploit this remotely by supplying a crafted media file that triggers the vulnerable code path when processed through FFmpeg's convolution filter, requiring user interaction (e.g., a user opening or processing the malicious file). The patch commits 8970658472 and e24b9820b4 address the flaw and are referenced in the FFmpeg issue tracker (VulDB, FFmpeg Issue, FFmpeg Commit).

Successful exploitation can result in limited confidentiality, integrity, and availability impacts — an attacker may read out-of-bounds memory contents (potentially leaking sensitive data), cause minor data corruption, or trigger a crash of the FFmpeg process. The scope is limited to the affected FFmpeg process and does not directly enable privilege escalation or lateral movement. Applications and services that automatically process user-supplied media files using FFmpeg's convolution filter are most at risk (Feedly, VulDB).

A proof-of-concept exploit has been publicly disclosed, as indicated by the CVSS v4.0 exploit maturity rating of "PROOF_OF_CONCEPT." No confirmed in-the-wild exploitation has been reported, and no threat actor attribution is available at this time. The EPSS score is 0.0, indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, ENISA EUVD).

1. Craft a malicious media file: Create a specially crafted video file designed to trigger the out-of-bounds read in the setup_3x3 function when processed with FFmpeg's convolution filter (e.g., using a malformed kernel or frame dimensions).
2. Deliver the file to the target: Distribute the crafted file via email attachment, web download, or any channel where the target user or automated system will process it with a vulnerable FFmpeg version.
3. Trigger processing with convolution filter: Ensure the file is processed using FFmpeg with the convolution filter applied (e.g., ffmpeg -i malicious.mp4 -vf convolution=... output.mp4), causing the vulnerable setup_3x3 function to be invoked.
4. Out-of-bounds read occurs: The improper memory access reads data beyond the intended buffer boundary, potentially leaking memory contents or causing a process crash.
5. Leverage output: Depending on the deployment context, the attacker may obtain leaked memory data (e.g., heap addresses, sensitive content) or cause a denial of service by crashing the FFmpeg process (VulDB, FFmpeg Issue).

• File System: Presence of unexpected or suspicious media files (e.g., .mp4, .mkv, .avi) submitted to FFmpeg processing pipelines; files with anomalous metadata or unusual convolution filter parameters.
• Logs: FFmpeg process logs showing crashes, segmentation faults, or error messages originating from libavfilter/vf_convolution.c or the setup_3x3 function; repeated processing failures on specific input files.
• Process: Unexpected termination or crash of FFmpeg worker processes; core dump files generated by FFmpeg in the working directory.

Upgrade FFmpeg to one of the following patched versions: 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, or 9.0. The fix is implemented in commits 8970658472 and e24b9820b4 in the FFmpeg repository. As a workaround where upgrading is not immediately possible, avoid processing untrusted media files with the convolution filter, or disable the convolution filter in FFmpeg deployments that handle user-supplied content (VulDB, FFmpeg Commit).