Skip to content
OpenAdvisories
Medium WID-SEC-2026-4419 121 CVEs

ffmpeg: Mehrere Schwachstellen

Published Nov 9, 2026 · Updated Nov 9, 2026 · de

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren oder offenzulegen, Sicherheitsmaßnahmen zu umgehen, Speicherbeschädigungen zu verursachen und möglicherweise beliebigen Code auszuführen.

Product

Das FFmpeg-Projekt besteht aus freien Programmen und Bibliotheken, die es ermöglichen, digitales Video- und Audiomaterial aufzunehmen, zu konvertieren, zu streamen und abzuspielen. Zudem enthält es mit libavcodec eine Audio- und Video-Codec-Sammlung, die verschiedene Codecs zur Verfügung stellt.

Vulnerabilities 121

  • High 7.8
    CVE-2026-125203

    FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with o…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • High 7.8
    CVE-2026-125209

    FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • High 7.8
    CVE-2026-125229

    FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor

    FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, s…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125233

    FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to t…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125244

    FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's sh_entry_points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces exce…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125250

    FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap

    FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing r…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125259

    FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the pr…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125262

    FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configu…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.8
    CVE-2026-125267

    FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an intege…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125181

    FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI_BRUN Byte Swap

    FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125196

    FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125201

    FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan_av1.c

    FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125202

    FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • High 7.0
    CVE-2026-125204

    FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment

    FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to wri…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • High 7.0
    CVE-2026-125208

    FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

    FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimension…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • High 7.0
    CVE-2026-125210

    FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a po…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125211

    FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup

    FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB cap…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125212

    FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcod…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125213

    FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125214

    FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125218

    FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng()

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPO…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125219

    FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpau_hevc_start_frame() in libavcodec/vdpau_hevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile colu…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125222

    FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125227

    FFmpeg through 9.0.2 Heap Buffer Overflow via cbs_jpeg_write_scan Integer Overflow

    FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstrea…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125235

    FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit_frame()

    FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grow…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125239

    FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_dxva2_hevc_fill_picture_parameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly s…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125241

    FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file who…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125248

    FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer

    FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125249

    FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

    FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125251

    FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a v…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125256

    FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 p…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125257

    FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search

    FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nell…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125260

    FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path

    FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolut…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • High 7.0
    CVE-2026-125269

    FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c

    FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientati…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 6.1
    CVE-2026-125171

    FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 6.1
    CVE-2026-125172

    FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NA…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 6.1
    CVE-2026-125178

    FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions

    FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_pai…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 6.1
    CVE-2026-125193

    FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked_decode_uyvy422()

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 6.1
    CVE-2026-125197

    FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding

    FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL vid…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 6.1
    CVE-2026-125261

    FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorot…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125064

    FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125065

    FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter fr…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125066

    FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR fra…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125067

    FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causi…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125068

    FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowin…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125070

    FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125073

    FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder

    FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits ne…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125104

    FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c

    FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nb…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125173

    FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper

    FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only pa…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125174

    FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an ov…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125180

    FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags

    FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125183

    FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing

    FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125185

    FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points

    FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI me…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125187

    FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()

    FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125194

    FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short fin…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125199

    FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1_decode_frame()

    FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125200

    FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads

    FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU all…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125205

    FFmpeg through 9.0.2 Memory Exhaustion via av1_frame_merge Bitstream Filter

    FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OB…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125207

    FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder

    FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 5.5
    CVE-2026-125216

    FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125220

    FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure

    FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter fra…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125221

    FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()

    FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looki…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125224

    FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

    FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125225

    FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit cou…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125226

    FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer

    FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a ver…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125230

    FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm_rechunk Filter

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125231

    FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

    FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extra…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125232

    FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

    FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MP…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125234

    FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack_encode_init

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125238

    FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper

    FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access unit…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125240

    FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper

    FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125254

    FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()

    FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.5
    CVE-2026-125264

    FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count

    FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.3
    CVE-2026-125228

    FFmpeg before 8.1.3 and 9.x before 9.0.2 Out-of-Bounds Read in Vorbis Encoder

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, ca…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.3
    CVE-2026-125253

    FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read

    FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame si…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.3
    CVE-2026-125255

    FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding

    FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof()…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.3
    CVE-2026-125265

    FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer

    FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecod…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 5.3
    CVE-2026-125270

    FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder

    FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125069

    FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, ca…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 4.7
    CVE-2026-125071

    FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, ov…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 4.7
    CVE-2026-125072

    FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder

    FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Medium 4.7
    CVE-2026-125186

    FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter

    FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slice…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125189

    FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter

    FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125191

    FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak

    FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, maki…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125215

    FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

    FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or al…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125223

    FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame

    FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile si…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125237

    FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path

    FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_f…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125242

    FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table

    FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pic…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125245

    FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding

    FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or faili…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125246

    FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment

    FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 ab…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125252

    FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers

    FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to pars…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125258

    FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

    FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a no…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Medium 4.7
    CVE-2026-125263

    FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

    FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125095

    FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure

    FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125096

    FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() cop…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125097

    FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125098

    FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125099

    FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to c…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125100

    FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to s…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125101

    FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125102

    FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125103

    FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or ou…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125170

    FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125175

    FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 str…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu
  • Low 3.3
    CVE-2026-125176

    FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated d…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125177

    FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data term…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125179

    FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125182

    FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes rea…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125184

    FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c

    FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CS…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125190

    FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder

    FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referenc…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125192

    FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer

    FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125217

    FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure

    FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transc…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125236

    FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()

    FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_frame() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125243

    FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125247

    FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c

    FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outpu…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125266

    FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23

    FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline …

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 3.3
    CVE-2026-125268

    FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeigh…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 2.5
    CVE-2026-125188

    FFmpeg through 9.0.2 ProRes prores_aw Heap Out-of-Bounds Read in Interlaced Encoding

    FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_templ…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 2.5
    CVE-2026-125195

    FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM_MS Trellis Encoding

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this en…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 2.5
    CVE-2026-125198

    FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer

    FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking nat…

    FFmpeg FFmpeg ffmpeg Ubuntu
  • Low 2.5
    CVE-2026-125206

    FFmpeg through 9.0.2 Out-of-Bounds Read via prores_ks Interlaced Alpha Encoding

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlace…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References