Ffmpeg - vulnerabilities (CVEs)

535 CVEs in 5 products, 9 in the last 30 days, newest from 2026-10-08.

Products

Ffmpeg - 525 CVEs
Lavf Demuxer - 1 CVEs
Libavcodec - 1 CVEs
Libswresample - 1 CVEs
Mpeg-dash - 1 CVEs

Newest CVEs of Ffmpeg

CVE-2026-107698 - CVSS 5.4 (medium), 2026-10-08: FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP…
CVE-2026-107697 - CVSS 5.3 (medium), 2026-10-08: FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions…
CVE-2026-107696 - CVSS 7.1 (high), 2026-10-08: FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect…
CVE-2026-107695 - CVSS 7.1 (high), 2026-10-08: FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because…
CVE-2026-107678 - CVSS 5.7 (medium), 2026-10-08: FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees…
CVE-2026-107677 - CVSS 5.7 (medium), 2026-10-08: FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty…
CVE-2026-107676 - CVSS 4.8 (medium), 2026-10-08: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes…
CVE-2026-107675 - CVSS 6 (medium), 2026-10-08: FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to…
CVE-2026-107660 - CVSS 6.3 (medium), 2026-10-08: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips…
CVE-2026-96611 - CVSS 7.8 (high), 2026-09-23: FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored…
CVE-2026-90816 - CVSS 5.3 (medium), 2026-09-14: A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser.…
CVE-2026-90815 - CVSS 6.3 (medium), 2026-09-14: A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file…
CVE-2026-52296 - CVSS 7.1 (high), 2026-09-13: FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
CVE-2026-52297 - CVSS 7.1 (high), 2026-09-13: FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.
CVE-2026-30754 - CVSS 8.8 (high), 2026-09-08: A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a…
CVE-2026-52295 - CVSS 6.2 (medium), 2026-09-01: FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.
CVE-2026-75147 - CVSS 7.1 (high), 2026-08-19: FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches…
CVE-2026-75146 - CVSS 8.1 (high), 2026-08-19: FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a…
CVE-2026-75145 - CVSS 5.8 (medium), 2026-08-19: FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to…
CVE-2026-75144 - CVSS 8.5 (high), 2026-08-19: FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers…
CVE-2026-75143 - CVSS 9.8 (critical), 2026-08-19: FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and…
CVE-2026-75142 - CVSS 8.5 (high), 2026-08-19: FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the…
CVE-2026-75141 - CVSS 8.5 (high), 2026-08-19: FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single…
CVE-2026-70632 - CVSS 8.5 (high), 2026-08-06: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that…
CVE-2026-70631 - CVSS 6.8 (medium), 2026-08-06: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in…
CVE-2026-70630 - CVSS 6.8 (medium), 2026-08-06: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder…
CVE-2026-70629 - CVSS 6.8 (medium), 2026-08-06: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c)…
CVE-2026-70628 - CVSS 8.5 (high), 2026-08-06: FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in…
CVE-2026-66041 - CVSS 8.8 (high), 2026-07-24: FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt…
CVE-2026-66040 - CVSS 8.8 (high), 2026-07-24: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote…