What is GHSA-923g-f8rq-pv4w?

GHSA-923g-f8rq-pv4w is a security advisory published by GitHub Security Advisories with Low severity. FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata...

Which CVE IDs does GHSA-923g-f8rq-pv4w cover?

GHSA-923g-f8rq-pv4w covers the following CVE IDs: CVE-2026-52296. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-923g-f8rq-pv4w?

GHSA-923g-f8rq-pv4w has a CVSS v3 base score of 2.9, published by GitHub Security Advisories.

GHSA-923g-f8rq-pv4wLowCVSS 2.9

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-52296 →

📋 Description

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-52296
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/23227a444de4a8f7696f46660cdd044b460f7e47
https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding
https://github.com/advisories/GHSA-923g-f8rq-pv4w