Ubuntu alert USN-8856-1 (kdenlive, mlt)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8856-1] Kdenlive, MLT vulnerability
Date:
             
 
Wed, 30 Sep 2026 16:47:02 +0000
Message-ID:
             
 
<E1xBxSQ-0001NV-6i@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8856-1
September 30, 2026

kdenlive, mlt vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

Kdenlive, MLT could be made to run programs as your login if it opened a
specially crafted file.

Software Description:
- kdenlive: KDE Non-Linear Video Editor
- mlt: Multimedia Framework

Details:

It was discovered that Kdenlive allowed dangerous proxy parameters when
processing attacker-controlled project files. An attacker could use this to
execute arbitrary commands via the MLT framework's ante/post consumer
properties.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  kdenlive                        4:25.12.3-0ubuntu1.1
  libmlt7                         7.36.1-1ubuntu3.1
  melt                            7.36.1-1ubuntu3.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8856-1
  CVE-2026-45184

Package Information:
  https://launchpad.net/ubuntu/+source/kdenlive/4:25.12.3-0...
  https://launchpad.net/ubuntu/+source/mlt/7.36.1-1ubuntu3.1


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq9O7MACgkQcpJm3tlz
hgF1hRAAlfufUBu2fYPn381M9PMfKVvwF35awXvb7Y5e/4Aj0CjK1E/HlgkUWo9Z
8RKElaXI0mVZlQ6YRn63TV4k9kI2hfvG8CtJGTVoX19eR9BGFeW31+V3hTLw23DJ
omJpmn2SLyIYK+Bnx6nZSIfdX+YyihTWGgVE2oM1jdAsEytfLSiMi82DCczXQGqN
gFCkQ1QQAH8kb8sjKArY7NILdHkIBV8fwGyoGkR+PAW3VZqSBV/2eeFwUuIL2azy
i1qchzeB0OJaxQDZR5yRJ7qZULXqANeAq/NCpByMPeA10x7VysMmGFuE68oS0u4T
PEyOwMZV/l+SR2CWe9eYM2ikS+b+rbZRo1Tp92KVUSUPujgdjhUI95Qd5BajuOvA
ifeP9iWYWvSEJg1+aLyxAFcMPIAS3Sskhc85+AiyPgKa82fuvBWI0N1rioicixjn
acM73NdTNR1kyyp/N2/5Y4uVYnO4XII15pzQPV9WhTlktVvBenHztSBEuT14O1V5
FyPvdr/f+zbx8OY2Z6JAhDZjW9mzU1ofbvs0OzS/pHdVAZsTLCye8DeLAZul0gdS
Tb/PCVmo0teYec6QdZsEiEusMTyhxUVpTbE8pVvEg4ENy1/EgIvALmfahFck9Frf
a89aoiYnsfc1Xh/tzZnrDTERJDmPg9AZ4+SqUjaWsMHJE0DFK6M=
=UN3w
-----END PGP SIGNATURE-----