Ubuntu USN-8856-1 Fixes Kdenlive, MLT Vulnerability

Quick Answer

USN-8856-1 fixes CVE-2026-45184 in Ubuntu 26.04's Kdenlive and MLT packages. A malicious project can supply dangerous proxy parameters that execute commands with the opening user's privileges. Update the installed editor and MLT runtime packages through Ubuntu's security repository before accepting outside projects; this is not a claim that every video file or separately packaged editor is covered.

Last verified: 2026-10-02 UTC against USN-8856-1 JSON, including the project trigger and binary-package versions.

Scope And Authority

Product scope	Kdenlive, MLT vulnerability on Ubuntu 26.04 LTS (resolute)
Advisory	USN-8856-1
CVE	CVE-2026-45184
Authoritative release date	2026-09-30 15:59:30.476360 UTC
Authority revision date	No separate material revision date is stated by Ubuntu; verified against the first-party notice API.
Affected versions	The Ubuntu releases and source packages enumerated in USN-8856-1: Ubuntu 26.04 LTS (resolute).
Fixed version	Selected runtime binaries; update those installed and their required dependencies. The linked USN has the full package list: resolute: kdenlive 4:25.12.3-0ubuntu1.1 (security) resolute: libmlt7 7.36.1-1ubuntu3.1 (security) resolute: melt 7.36.1-1ubuntu3.1 (security)
CVSS base score	Not provided by the authority
CVSS severity	Not provided by the authority
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

Canonical identifies attacker-controlled project proxy parameters passed to MLT's ante/post consumer properties. The impact is command execution as the user, not merely a failed preview. Treat received project files as active inputs; media that plays normally is not evidence that a project containing processing instructions is safe.

What To Validate Now

1. Identify the real editor/runtime. Match the launched editor and render workers to Ubuntu 26.04 packages. A package update does not necessarily alter another copy launched from a desktop shortcut.
2. Save before updating. Preserve the project and referenced media, stop or finish approved render jobs, and close the old processes. Use a duplicate project for post-update checks rather than overwriting the only working copy.
3. Apply the binary fixes. Update the installed packages listed above through the resolute security repository. mlt is the source label here; libmlt7 and melt are the listed runtime binaries.
4. Check the actual workflow. Reopen the updated editor with a trusted project copy, create proxies where normally used and render a short benign segment. Confirm expected output, audio/video alignment and absence of unexpected child commands or errors.
5. Keep the boundary. Record package versions and test results without attaching private media. Do not enable unsafe project behavior or open a malicious proof of concept on the production editing workstation to validate this notice.

Operational Cautions

These resolute builds are in the security pocket. The notice's general system-update instruction is not evidence that an already running editor or an independent application bundle has been replaced. Keep project backups and investigate render regressions without broadly relaxing permissions. No editor or exploit test was performed here.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• USN-8856-1

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.