---
title: "CVE-2026-89724: Linux kernel media vicodec - Out-of-Bounds Write"
description: "Linux kernel media vicodec contains an out-of-bounds write caused by incorrect buffer sizing in the FWHT encoder, letting attackers corrupt adjacent kernel heap memory, exploit requires crafted video frames."
url: https://panop.io/threat-heartbeat/CVE-2026-89724/
---

# CVE-2026-89724 Linux kernel media vicodec - Out-of-Bounds Write

Linux kernel media vicodec contains an out-of-bounds write caused by incorrect buffer sizing in the FWHT encoder, letting attackers corrupt adjacent kernel heap memory, exploit requires crafted video frames.

CVSS base score 7.8 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Required

EPSS

0.17% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89724)

## Details

Type

Out-of-Bounds Write

Impact

Denial Of Service, Privilege Escalation

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the fix that bumps pixfmt\_fwht.sizeimage\_mult from 3 to 4.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89724](https://nvd.nist.gov/vuln/detail/CVE-2026-89724)
- [https://git.kernel.org/stable/c/6ea647e76c44387d5c1c635df4604c2154d9060e](https://git.kernel.org/stable/c/6ea647e76c44387d5c1c635df4604c2154d9060e)
- [https://git.kernel.org/stable/c/d40838a63f2bd6a3df0a6cdd8ff1d5c6366e8fff](https://git.kernel.org/stable/c/d40838a63f2bd6a3df0a6cdd8ff1d5c6366e8fff)
- [https://git.kernel.org/stable/c/e21cccc29b840930cd9dcfdf1139658063a681af](https://git.kernel.org/stable/c/e21cccc29b840930cd9dcfdf1139658063a681af)
- [https://git.kernel.org/stable/c/f7ae26c100a6c26c2a166d2c41e73188067b36bd](https://git.kernel.org/stable/c/f7ae26c100a6c26c2a166d2c41e73188067b36bd)
- [https://git.kernel.org/stable/c/84cfebf7f4229d748cca8eb9c4e1f1c4099d3ab7](https://git.kernel.org/stable/c/84cfebf7f4229d748cca8eb9c4e1f1c4099d3ab7)
- [https://git.kernel.org/stable/c/8c14472431e27f13661d0db9d837156eaced0ecb](https://git.kernel.org/stable/c/8c14472431e27f13661d0db9d837156eaced0ecb)
- [https://git.kernel.org/stable/c/b95315ffc66b39856396c1043618bb4e4d5785ba](https://git.kernel.org/stable/c/b95315ffc66b39856396c1043618bb4e4d5785ba)
- [https://git.kernel.org/stable/c/cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9](https://git.kernel.org/stable/c/cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)