{"cve":"CVE-2026-93236","nvd":{"published":"2026-09-24T16:17:19.297","modified":"2026-10-19T10:17:14.663","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common\n\nWhen VIDIOC_TRY_FMT is called with an unsupported pixel format on the\nOUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2.\nHowever, if a distro has locally patched MPEG2 support out (as it has\nbeen broken for some time) the platform format table does not contain\nMPEG2 so find_format() returns NULL and the subsequent dereference of\nfmt_out->max_width triggers a NULL pointer dereference.\n\nFix this by falling back to the first format in the platform's format\narray instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid\nsince every platform defines at least one format.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/20aa934ace6917262ff579a73ec018d06a7bad1c","https://git.kernel.org/stable/c/276f28672bb6d5d5feca78db4219c7b5adf1be26","https://git.kernel.org/stable/c/3839b6be2279fc4f558723f2c0fbfc9c42070958","https://git.kernel.org/stable/c/680a89683197cdfe4e03e6fd7755454c647d39c1","https://git.kernel.org/stable/c/96dafbae77f50bfe2228bcfedcd8652c5e5f08e8"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-93236","score":0.00211,"percentile":0.11188,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}