Public bug reported:
I run a Mastodon server on Ubuntu 24.04 LTS.
Mastodon runs ffmpeg and ffprobe over media that federates in from other
servers. That happens automatically in the background, nobody clicks
anything, and the files come from wherever. CVE-2026-8461 is a heap out-
of-bounds write in ffmpeg's MagicYUV decoder, rated 8.8, so that's
untrusted video going straight into vulnerable decoding code.
It isn't only Mastodon. PeerTube handles federated video the same way,
and anything that transcodes uploads or generates thumbnails is running
the same decoder over files it didn't create.
As far as I can tell Ubuntu hasn't fixed it. The security tracker still
shows ffmpeg as "needs evaluation" for both 24.04 and 26.04, and the
changelog on my own machine doesn't mention it. Upstream put out fixed
releases back in June, including 6.1.6, which is the same series 24.04
ships.
I ended up building ffmpeg from source myself and pointing Mastodon at
that instead. It works, but it doesn't feel like a reasonable thing to
expect of everyone running one of these servers, and most of them won't
even know there's anything to worry about.
There are a lot of fediverse servers on Ubuntu LTS. Can someone take a
look at this please?
----
$ lsb_release -rd
Description: Ubuntu 24.04.4 LTS
Release: 24.04
$ apt-cache policy ffmpeg
ffmpeg:
Installed: 7:6.1.1-3ubuntu5+esm10
** Affects: ffmpeg (Ubuntu)
Importance: Undecided
Status: New
** Tags: noble resolute
** CVE added: https://cve.org/CVERecord?id=CVE-2026-8461
** Tags added: noble resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162027
Title:
CVE-2026-8461 in LTS 24.04 and 26.04 (upstream fix available)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ffmpeg/+bug/2162027/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
