SECURITY ANNOUNCEMENT

CVE-2026-99056

23 October 2026

Switch the stopped/paused/etc bits to u8's to avoid races between strp_stop() and strp_pause/unpause(). A reproducer has been published and turns the possible UAF into an

Introduced

5.6e27cca96cd68fa2c6814c90f9a1cfd36bb68c593

Fixed releases

6.12.1139f3e9fe1b155e9b4572054d8d140586bc3512ecf

6.18.57d2b5f637b9b67a79a50d42614d10653c13b4e449

6.6.160a18dd388045dc7263d99a07db9de4e0f149ca8f1

7.2.11eaa3a29004c063d7e9d5ea55636f693f67e6db0f

7.30984ebc631792acf8fff105112ee74a6b8f1efcc

View source announcement ↗