Activity

1. MDSALMANSHAMS commented on Sep 15, 2026

   

   MDSALMANSHAMS

   on Sep 15, 2026

   Contributor

   More actions

   Confirmed the 5 CVEs — all FIXED IN: v9, and specifically for CVE-2026-70632 that's not a floor, ffmpeg's own advisory scopes it to versions 4.4 through 9.0 exclusive, so no 8.x patch release covers it. The INSTALLED: v8.1.1 in the report is against the currently published wheel (5.0.0.93, uploaded 07-02); source on 5.x already carries 8.1.2 from #1249, which is still in-range for these.

   This one isn't a simple FFMPEG_VERSION bump like #1233/#1249 though, because of a dependency on opencv/opencv core, not just this repo:

   • ffmpeg 9.0 is an ABI break (all 7 libs re-versioned) and removed AVCodec::pix_fmts / AVCodec::supported_framerates, which cap_ffmpeg_hw.hpp / cap_ffmpeg_impl.hpp read directly.
   • That's fixed in core by videoio: fix build with FFmpeg 9 after AVCodec::pix_fmts removal opencv#29533 (merged 2026-08-11, routes through avcodec_get_supported_config()), but the 5.x submodule pin here is still 40738fb1 = the 5.0.0 tag (2026-06-05), from before that fix. Bumping just the Dockerfile ARG to 9.0 would break the build without also moving the submodule pin forward, and I don't see a tagged core release yet (4.14.0 on 07-19 is still the latest, also pre-#29533).

   @asmorkalov — is there a core release planned that picks up #29533, or is pinning the submodule to a post-08-11 commit acceptable here? Happy to put up the version bump (Dockerfiles + submodule pin) across the 7 build variants once that's clear. Same dependency applies to #1258.
2. aremishevsky commented on Oct 6, 2026

   

   aremishevsky

   on Oct 6, 2026

   More actions

   Hi @asmorkalov do we have some updates on this?
   Thanks