This bug was fixed in the package kdenlive - 4:25.12.3-0ubuntu1.1
---------------
kdenlive (4:25.12.3-0ubuntu1.1) resolute-security; urgency=medium
* SECURITY UPDATE: Remote code execution via malicious project file.
(LP: #2168441)
- debian/patches/CVE-2026-45184-1.patch: Warn user on invalid
preset on document open
- debian/patches/CVE-2026-45184-2.patch: Ensure we don't execute
unwanted commands on MLT < 7.40
- debian/patches/CVE-2026-45184-3.patch: Cleanup proxy parameters
- CVE-2026-45184
-- Rik Mills <[email protected]> Thu, 24 Sep 2026 14:46:34 +0100
** Changed in: kdenlive (Ubuntu)
Status: Confirmed => Fix Released
** Changed in: mlt (Ubuntu)
Status: Confirmed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168441
Title:
Kdenlive: Remote code execution via malicious project file
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kdenlive/+bug/2168441/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
