CVE-2026-21069
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
Risk Assessment
A local attacker may cause memory corruption, potentially leading to system crashes or privilege escalation.
Recommendation
Install SMR Aug-2026 Release 1 or later to fix the numeric conversion error in the VC1 codec.
Other vulnerabilities in libsavsvc.so
See all- CVE-2026-21072High
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
- CVE-2026-21071High
Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
Original NVD description (English source)
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.