CVE-2026-6385
Medium
Description
A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Lightspeed Core
PublishedApr 15, 2026
First seenApr 15, 2026
Weakness typeCWE-190Integer overflow
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Lightspeed Core | No range specified | — |
| Red Hat Red Hat AI Inference Server | No range specified | — |
| Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 | No range specified | — |
| Red Hat Red Hat OpenShift AI (RHOAI) | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.