{"id":"CVE-2026-96611","published":"2026-09-23T15:17:34.160","lastModified":"2026-09-26T23:16:42.097","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks.","cvssScore":6.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-190"],"vendors":[],"products":[],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","tags":[]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}