Vendor
FFmpeg
60 known vulnerabilities.
FFmpeg at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 5 | 0 |
| Oct 2026 | 10 | 0 |
| Sep 2026 | 4 | 0 |
| Aug 2026 | 12 | 1 |
| Jul 2026 | 16 | 0 |
| Jun 2026 | 2 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 7 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 1 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
60 results · Feed
-
Medium 5.5
FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …
-
Medium 5.5
FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palet…
-
Medium 5.5
FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the unclea…
-
Medium 5.5
FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame()…
-
Medium 5.5
FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kem…
-
Medium 4.3
FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux…
-
Medium 4.3
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use …
-
Medium 5.4
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to inter…
-
Medium 6.5
FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or …
-
Medium 6.5
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a cra…
-
Medium 4.7
FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a craft…
-
Medium 4.7
FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so g…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/…
-
Medium 5.9
FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords…
-
Medium 4.8
FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections t…
-
Medium 6.9
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values …
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in li…
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in…
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-b…
-
High 7.1
FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length …
-
High 8.1
FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragm…
-
Medium 5.8
FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including …
-
High 7.8
FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-…
-
Critical 9.8
FFmpeg Heap Buffer Overflow via RIST Protocol Reader
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it …
-
High 7.8
FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c
FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive …
-
High 7.8
FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflo…
-
High 7.8
FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. …
-
Medium 5.5
FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-com…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compr…
-
High 7.8
FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overfl…
-
High 8.8
FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter
FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers…
-
High 8.8
FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers ca…
-
High 8.8
FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craf…
-
Medium 6.5
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expe…
-
Medium 6.5
FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted c…
-
High 8.8
FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph…
-
High 7.8
FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a…
-
High 7.8
FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_f…
-
High 7.8
FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without boun…