CVE-2026-8461, a memory corruption vulnerability in the third-party FFmpeg library, has been found to affect Qt Multimedia. The Qt Multimedia versions listed below include a vulnerable version of FFmpeg, which is used by the Qt Multimedia FFmpeg media backend. Users of Qt Multimedia should update.
Only the Qt binary distribution is directly affected, because it bundles the FFmpeg libraries. Users who build Qt from source are affected if they link Qt Multimedia against an FFmpeg version that does not contain the upstream fix.
Affected versions: from Qt 6.8.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1
Affected status unknown before Qt 6.8.0
Impact: Processing a specially crafted media file through the FFmpeg backend could cause the application to crash. In some cases it could allow arbitrary code execution. Exploitability within Qt Multimedia has not been determined, so users should assume the worst case.
CVSS 3.1 Score (upstream): 8.8 / HIGH
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Mitigation: If you cannot update Qt yet, rebuild the FFmpeg libraries used by your application with FFmpeg 7.1.5, which contains the upstream security fix, and redeploy them with your application. You can do this without changing your Qt version. Until then, avoid playing or processing media files from untrusted sources.
Solution: Update to Qt 6.8.9 or Qt 6.11.2 or later. Both include the bundled FFmpeg 7.1.5.
