# cve.now: Ffmpeg

The newest entries naming Ffmpeg as an affected vendor (up to 200), of 181 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125270](https://cve.now/CVE-2026-125270.md): FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder (CVSS 5.8)
- [CVE-2026-125269](https://cve.now/CVE-2026-125269.md): FFmpeg through 9.0.2 Double Free via cbs\_sei\_delete\_message in cbs\_sei.c (CVSS 7.3)
- [CVE-2026-125268](https://cve.now/CVE-2026-125268.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder (CVSS 4.8)
- [CVE-2026-125267](https://cve.now/CVE-2026-125267.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder (CVSS 8.5)
- [CVE-2026-125266](https://cve.now/CVE-2026-125266.md): FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23 (CVSS 4.8)
- [CVE-2026-125265](https://cve.now/CVE-2026-125265.md): FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer (CVSS 5.8)
- [CVE-2026-125264](https://cve.now/CVE-2026-125264.md): FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count (CVSS 6.8)
- [CVE-2026-125263](https://cve.now/CVE-2026-125263.md): FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions (CVSS 5.7)
- [CVE-2026-125262](https://cve.now/CVE-2026-125262.md): FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding (CVSS 8.5)
- [CVE-2026-125261](https://cve.now/CVE-2026-125261.md): FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c (CVSS 6.9)
- [CVE-2026-125260](https://cve.now/CVE-2026-125260.md): FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path (CVSS 7.3)
- [CVE-2026-125259](https://cve.now/CVE-2026-125259.md): FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores\_ks Encoder (CVSS 8.5)
- [CVE-2026-125258](https://cve.now/CVE-2026-125258.md): FFmpeg through 9.0.2 Division by Zero via dovi\_configure\_ext() in dovi\_rpuenc.c (CVSS 5.7)
- [CVE-2026-125257](https://cve.now/CVE-2026-125257.md): FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search (CVSS 7.3)
- [CVE-2026-125256](https://cve.now/CVE-2026-125256.md): FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff\_bytes Routine (CVSS 7.3)
- [CVE-2026-125255](https://cve.now/CVE-2026-125255.md): FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding (CVSS 5.8)
- [CVE-2026-125254](https://cve.now/CVE-2026-125254.md): FFmpeg through 9.0.2 Division by Zero via VVC ff\_vvc\_slice\_rpl() (CVSS 6.8)
- [CVE-2026-125253](https://cve.now/CVE-2026-125253.md): FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read (CVSS 5.8)
- [CVE-2026-125252](https://cve.now/CVE-2026-125252.md): FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers (CVSS 5.7)
- [CVE-2026-125251](https://cve.now/CVE-2026-125251.md): FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c (CVSS 7.3)
- [CVE-2026-125250](https://cve.now/CVE-2026-125250.md): FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk\_buf Remap (CVSS 8.5)
- [CVE-2026-125249](https://cve.now/CVE-2026-125249.md): FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing (CVSS 7.3)
- [CVE-2026-125248](https://cve.now/CVE-2026-125248.md): FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer (CVSS 7.3)
- [CVE-2026-125247](https://cve.now/CVE-2026-125247.md): FFmpeg through 9.0.2 Integer Overflow via dng\_decode\_tiles() in libavcodec/tiff.c (CVSS 4.8)
- [CVE-2026-125246](https://cve.now/CVE-2026-125246.md): FFmpeg through 9.0.2 Assertion Failure DoS via cbs\_jpeg\_assemble\_fragment (CVSS 5.7)
- [CVE-2026-125245](https://cve.now/CVE-2026-125245.md): FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding (CVSS 5.7)
- [CVE-2026-125244](https://cve.now/CVE-2026-125244.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh\_entry\_points (CVSS 8.5)
- [CVE-2026-125243](https://cve.now/CVE-2026-125243.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder (CVSS 4.8)
- [CVE-2026-125242](https://cve.now/CVE-2026-125242.md): FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table (CVSS 5.7)
- [CVE-2026-125241](https://cve.now/CVE-2026-125241.md): FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check\_pixel\_ptr (CVSS 7.3)
- [CVE-2026-125240](https://cve.now/CVE-2026-125240.md): FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper (CVSS 6.8)
- [CVE-2026-125239](https://cve.now/CVE-2026-125239.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters (CVSS 7.3)
- [CVE-2026-125238](https://cve.now/CVE-2026-125238.md): FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper (CVSS 6.8)
- [CVE-2026-125237](https://cve.now/CVE-2026-125237.md): FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path (CVSS 5.7)
- [CVE-2026-125236](https://cve.now/CVE-2026-125236.md): FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc\_frame() (CVSS 4.8)
- [CVE-2026-125235](https://cve.now/CVE-2026-125235.md): FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit\_frame() (CVSS 7.3)
- [CVE-2026-125234](https://cve.now/CVE-2026-125234.md): FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack\_encode\_init (CVSS 6.8)
- [CVE-2026-125233](https://cve.now/CVE-2026-125233.md): FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder (CVSS 8.5)
- [CVE-2026-125232](https://cve.now/CVE-2026-125232.md): FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation (CVSS 6.8)
- [CVE-2026-125231](https://cve.now/CVE-2026-125231.md): FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx\_decode\_header() (CVSS 6.8)
- [CVE-2026-125230](https://cve.now/CVE-2026-125230.md): FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm\_rechunk Filter (CVSS 6.8)
- [CVE-2026-125229](https://cve.now/CVE-2026-125229.md): FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor (CVSS 8.5)
- [CVE-2026-125228](https://cve.now/CVE-2026-125228.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Out-of-Bounds Read in Vorbis Encoder (CVSS 5.8)
- [CVE-2026-125227](https://cve.now/CVE-2026-125227.md): FFmpeg through 9.0.2 Heap Buffer Overflow via cbs\_jpeg\_write\_scan Integer Overflow (CVSS 7.3)
- [CVE-2026-125226](https://cve.now/CVE-2026-125226.md): FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer (CVSS 6.8)
- [CVE-2026-125225](https://cve.now/CVE-2026-125225.md): FFmpeg through 9.0.2 NULL Pointer Dereference via aac\_adtstoasc Bitstream Filter (CVSS 6.8)
- [CVE-2026-125224](https://cve.now/CVE-2026-125224.md): FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata (CVSS 6.8)
- [CVE-2026-125223](https://cve.now/CVE-2026-125223.md): FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9\_decode\_frame (CVSS 5.7)
- [CVE-2026-125222](https://cve.now/CVE-2026-125222.md): FFmpeg through 9.0.2 Heap Buffer Overflow via hap\_parse\_frame\_header() (CVSS 7.3)
- [CVE-2026-125221](https://cve.now/CVE-2026-125221.md): FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score\_header() (CVSS 6.8)
- [CVE-2026-125220](https://cve.now/CVE-2026-125220.md): FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure (CVSS 6.8)
- [CVE-2026-125219](https://cve.now/CVE-2026-125219.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays (CVSS 7.3)
- [CVE-2026-125218](https://cve.now/CVE-2026-125218.md): FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode\_apng() (CVSS 7.3)
- [CVE-2026-125217](https://cve.now/CVE-2026-125217.md): FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure (CVSS 4.8)
- [CVE-2026-125216](https://cve.now/CVE-2026-125216.md): FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode\_gbrp12() (CVSS 6.8)
- [CVE-2026-125215](https://cve.now/CVE-2026-125215.md): FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff\_dovi\_rpu\_generate() (CVSS 5.7)
- [CVE-2026-125214](https://cve.now/CVE-2026-125214.md): FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder (CVSS 7.3)
- [CVE-2026-125213](https://cve.now/CVE-2026-125213.md): FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path (CVSS 7.3)
- [CVE-2026-125212](https://cve.now/CVE-2026-125212.md): FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder (CVSS 7.3)
- [CVE-2026-125211](https://cve.now/CVE-2026-125211.md): FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup (CVSS 7.3)
- [CVE-2026-125210](https://cve.now/CVE-2026-125210.md): FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding (CVSS 7.3)
- [CVE-2026-125209](https://cve.now/CVE-2026-125209.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c (CVSS 8.5)
- [CVE-2026-125208](https://cve.now/CVE-2026-125208.md): FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2\_buffers.c (CVSS 7.3)
- [CVE-2026-125207](https://cve.now/CVE-2026-125207.md): FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder (CVSS 6.8)
- [CVE-2026-125206](https://cve.now/CVE-2026-125206.md): FFmpeg through 9.0.2 Out-of-Bounds Read via prores\_ks Interlaced Alpha Encoding (CVSS 2.0)
- [CVE-2026-125205](https://cve.now/CVE-2026-125205.md): FFmpeg through 9.0.2 Memory Exhaustion via av1\_frame\_merge Bitstream Filter (CVSS 6.8)
- [CVE-2026-125204](https://cve.now/CVE-2026-125204.md): FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment (CVSS 7.3)
- [CVE-2026-125203](https://cve.now/CVE-2026-125203.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder (CVSS 8.5)
- [CVE-2026-125202](https://cve.now/CVE-2026-125202.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays (CVSS 7.3)
- [CVE-2026-125201](https://cve.now/CVE-2026-125201.md): FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan\_av1.c (CVSS 7.3)
- [CVE-2026-125200](https://cve.now/CVE-2026-125200.md): FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads (CVSS 6.8)
- [CVE-2026-125199](https://cve.now/CVE-2026-125199.md): FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1\_decode\_frame() (CVSS 6.8)
- [CVE-2026-125198](https://cve.now/CVE-2026-125198.md): FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer (CVSS 2.0)
- [CVE-2026-125197](https://cve.now/CVE-2026-125197.md): FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding (CVSS 6.9)
- [CVE-2026-125196](https://cve.now/CVE-2026-125196.md): FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper (CVSS 7.3)
- [CVE-2026-125195](https://cve.now/CVE-2026-125195.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM\_MS Trellis Encoding (CVSS 2.0)
- [CVE-2026-125194](https://cve.now/CVE-2026-125194.md): FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder (CVSS 6.8)
- [CVE-2026-125193](https://cve.now/CVE-2026-125193.md): FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked\_decode\_uyvy422() (CVSS 6.9)
- [CVE-2026-125192](https://cve.now/CVE-2026-125192.md): FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer (CVSS 4.8)
- [CVE-2026-125191](https://cve.now/CVE-2026-125191.md): FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak (CVSS 5.7)
- [CVE-2026-125190](https://cve.now/CVE-2026-125190.md): FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder (CVSS 4.8)
- [CVE-2026-125189](https://cve.now/CVE-2026-125189.md): FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc\_metadata Bitstream Filter (CVSS 5.7)
- [CVE-2026-125188](https://cve.now/CVE-2026-125188.md): FFmpeg through 9.0.2 ProRes prores\_aw Heap Out-of-Bounds Read in Interlaced Encoding (CVSS 2.0)
- [CVE-2026-125187](https://cve.now/CVE-2026-125187.md): FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta\_encode\_frame() (CVSS 6.8)
- [CVE-2026-125186](https://cve.now/CVE-2026-125186.md): FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter (CVSS 5.7)
- [CVE-2026-125185](https://cve.now/CVE-2026-125185.md): FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points (CVSS 6.8)
- [CVE-2026-125184](https://cve.now/CVE-2026-125184.md): FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c (CVSS 4.8)
- [CVE-2026-125183](https://cve.now/CVE-2026-125183.md): FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing (CVSS 6.8)
- [CVE-2026-125182](https://cve.now/CVE-2026-125182.md): FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js\_subband\_start (CVSS 4.8)
- [CVE-2026-125181](https://cve.now/CVE-2026-125181.md): FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI\_BRUN Byte Swap (CVSS 7.3)
- [CVE-2026-125180](https://cve.now/CVE-2026-125180.md): FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags (CVSS 6.8)
- [CVE-2026-125179](https://cve.now/CVE-2026-125179.md): FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder (CVSS 4.8)
- [CVE-2026-125178](https://cve.now/CVE-2026-125178.md): FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions (CVSS 6.9)
- [CVE-2026-125177](https://cve.now/CVE-2026-125177.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder (CVSS 4.8)
- [CVE-2026-125176](https://cve.now/CVE-2026-125176.md): FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder (CVSS 4.8)
- [CVE-2026-125175](https://cve.now/CVE-2026-125175.md): FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder (CVSS 4.8)
- [CVE-2026-125174](https://cve.now/CVE-2026-125174.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff\_hap\_set\_chunk\_count() (CVSS 6.8)
- [CVE-2026-125173](https://cve.now/CVE-2026-125173.md): FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper (CVSS 6.8)
- [CVE-2026-125172](https://cve.now/CVE-2026-125172.md): FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length (CVSS 6.9)
- [CVE-2026-125171](https://cve.now/CVE-2026-125171.md): FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c (CVSS 6.9)
- [CVE-2026-125170](https://cve.now/CVE-2026-125170.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa\_decode\_rle() (CVSS 4.8)
- [CVE-2026-125104](https://cve.now/CVE-2026-125104.md): FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c (CVSS 6.8)
- [CVE-2026-125103](https://cve.now/CVE-2026-125103.md): FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder (CVSS 4.8)
- [CVE-2026-125102](https://cve.now/CVE-2026-125102.md): FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c (CVSS 4.8)
- [CVE-2026-125101](https://cve.now/CVE-2026-125101.md): FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure (CVSS 4.8)
- [CVE-2026-125100](https://cve.now/CVE-2026-125100.md): FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count (CVSS 4.8)
- [CVE-2026-125099](https://cve.now/CVE-2026-125099.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder (CVSS 4.8)
- [CVE-2026-125098](https://cve.now/CVE-2026-125098.md): FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk (CVSS 4.8)
- [CVE-2026-125097](https://cve.now/CVE-2026-125097.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder (CVSS 4.8)
- [CVE-2026-125096](https://cve.now/CVE-2026-125096.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder (CVSS 4.8)
- [CVE-2026-125095](https://cve.now/CVE-2026-125095.md): FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure (CVSS 4.8)
- [CVE-2026-125073](https://cve.now/CVE-2026-125073.md): FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder (CVSS 6.8)
- [CVE-2026-125072](https://cve.now/CVE-2026-125072.md): FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder (CVSS 5.7)
- [CVE-2026-125071](https://cve.now/CVE-2026-125071.md): FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder (CVSS 5.7)
- [CVE-2026-125070](https://cve.now/CVE-2026-125070.md): FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder (CVSS 6.8)
- [CVE-2026-125069](https://cve.now/CVE-2026-125069.md): FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder (CVSS 5.7)
- [CVE-2026-125068](https://cve.now/CVE-2026-125068.md): FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder (CVSS 6.8)
- [CVE-2026-125067](https://cve.now/CVE-2026-125067.md): FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble\_decode\_frame() (CVSS 6.8)
- [CVE-2026-125066](https://cve.now/CVE-2026-125066.md): FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder (CVSS 6.8)
- [CVE-2026-125065](https://cve.now/CVE-2026-125065.md): FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c (CVSS 6.8)
- [CVE-2026-125064](https://cve.now/CVE-2026-125064.md): FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder (CVSS 6.8)
- [CVE-2026-120247](https://cve.now/CVE-2026-120247.md): FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure (CVSS 6.8)
- [CVE-2026-120246](https://cve.now/CVE-2026-120246.md): FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder (CVSS 6.8)
- [CVE-2026-120245](https://cve.now/CVE-2026-120245.md): FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder (CVSS 6.8)
- [CVE-2026-120244](https://cve.now/CVE-2026-120244.md): FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder (CVSS 6.8)
- [CVE-2026-120243](https://cve.now/CVE-2026-120243.md): FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette (CVSS 6.8)
- [CVE-2026-120210](https://cve.now/CVE-2026-120210.md): FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path (CVSS 5.3)
- [CVE-2026-107698](https://cve.now/CVE-2026-107698.md): FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling (CVSS 5.3)
- [CVE-2026-107697](https://cve.now/CVE-2026-107697.md): FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse\_playlist() (CVSS 5.3)
- [CVE-2026-107696](https://cve.now/CVE-2026-107696.md): FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c (CVSS 7.1)
- [CVE-2026-107695](https://cve.now/CVE-2026-107695.md): FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist (CVSS 7.1)
- [CVE-2026-107678](https://cve.now/CVE-2026-107678.md): FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes (CVSS 5.7)
- [CVE-2026-107677](https://cve.now/CVE-2026-107677.md): FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media (CVSS 5.7)
- [CVE-2026-107676](https://cve.now/CVE-2026-107676.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer (CVSS 4.8)
- [CVE-2026-107675](https://cve.now/CVE-2026-107675.md): FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol (CVSS 6.0)
- [CVE-2026-107660](https://cve.now/CVE-2026-107660.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts (CVSS 6.3)
- [CVE-2026-96611](https://cve.now/CVE-2026-96611.md): FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. (CVSS 6.9)
- [CVE-2026-52297](https://cve.now/CVE-2026-52297.md): FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov\_read\_iacb in lib (CVSS 2.9)
- [CVE-2026-52296](https://cve.now/CVE-2026-52296.md): FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c. (CVSS 2.9)
- [CVE-2026-52295](https://cve.now/CVE-2026-52295.md): FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavf (CVSS 2.9)
- [CVE-2026-75147](https://cve.now/CVE-2026-75147.md): FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc\_av1.c (CVSS 6.9)
- [CVE-2026-75146](https://cve.now/CVE-2026-75146.md): FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c (CVSS 7.2)
- [CVE-2026-75145](https://cve.now/CVE-2026-75145.md): FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer (CVSS 5.8)
- [CVE-2026-75144](https://cve.now/CVE-2026-75144.md): FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer (CVSS 8.5)
- [CVE-2026-75143](https://cve.now/CVE-2026-75143.md): FFmpeg Heap Buffer Overflow via RIST Protocol Reader (CVSS 9.3)
- [CVE-2026-75142](https://cve.now/CVE-2026-75142.md): FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c (CVSS 8.5)
- [CVE-2026-75141](https://cve.now/CVE-2026-75141.md): FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing (CVSS 8.5)
- [CVE-2026-70632](https://cve.now/CVE-2026-70632.md): FFmpeg 4.4 \< 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing (CVSS 8.5)
- [CVE-2026-70631](https://cve.now/CVE-2026-70631.md): FFmpeg 0.5 \< 9.0 Uninitialized Heap Memory Read in TIFF Decoder (CVSS 6.8)
- [CVE-2026-70630](https://cve.now/CVE-2026-70630.md): FFmpeg 3.0 \< 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder (CVSS 6.8)
- [CVE-2026-70629](https://cve.now/CVE-2026-70629.md): FFmpeg 3.0 \< 9.0 Uninitialized Heap Memory Read in RSCC Decoder (CVSS 6.8)
- [CVE-2026-70628](https://cve.now/CVE-2026-70628.md): FFmpeg 0.5 \< 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File (CVSS 8.5)
- [CVE-2026-66041](https://cve.now/CVE-2026-66041.md): FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf\_quirc Filter (CVSS 7.7)
- [CVE-2026-66040](https://cve.now/CVE-2026-66040.md): FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder (CVSS 8.7)
- [CVE-2026-66039](https://cve.now/CVE-2026-66039.md): FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (CVSS 8.7)
- [CVE-2026-66038](https://cve.now/CVE-2026-66038.md): FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (CVSS 7.1)
- [CVE-2026-66037](https://cve.now/CVE-2026-66037.md): FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix\_presentation\_obu() (CVSS 7.1)
- [CVE-2026-66036](https://cve.now/CVE-2026-66036.md): FFmpeg Heap Out-of-Bounds Write in vf\_hqdn3d Filter (CVSS 7.7)
- [CVE-2026-65706](https://cve.now/CVE-2026-65706.md): FFmpeg 3.0 - 8.1.2 vf\_swaprect Out-of-Bounds Write via NV12 Frame Processing (CVSS 8.5)
- [CVE-2026-65705](https://cve.now/CVE-2026-65705.md): FFmpeg 3.4 - 8.1.2 vf\_floodfill Out-of-Bounds Write via filter\_frame() (CVSS 7.3)
- [CVE-2026-65704](https://cve.now/CVE-2026-65704.md): FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder (CVSS 7.3)
- [CVE-2026-65703](https://cve.now/CVE-2026-65703.md): FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder (CVSS 8.5)
- [CVE-2026-64835](https://cve.now/CVE-2026-64835.md): FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder (CVSS 8.7)
- [CVE-2026-64834](https://cve.now/CVE-2026-64834.md): FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer (CVSS 8.7)
- [CVE-2026-64833](https://cve.now/CVE-2026-64833.md): FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (CVSS 7.1)
- [CVE-2026-64832](https://cve.now/CVE-2026-64832.md): FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c (CVSS 8.7)
- [CVE-2026-64831](https://cve.now/CVE-2026-64831.md): FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder (CVSS 8.7)
- [CVE-2026-64830](https://cve.now/CVE-2026-64830.md): FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer (CVSS 8.7)
- [CVE-2026-58049](https://cve.now/CVE-2026-58049.md): FFmpeg - Out-of-Bounds Write in RASC Decoder decode\_dlta() (CVSS 8.6)
- [CVE-2026-8461](https://cve.now/CVE-2026-8461.md): Heap out-of-bounds write via odd slice\_height in FFmpeg MagicYUV decoder (CVSS 8.8)
- [CVE-2026-40962](https://cve.now/CVE-2026-40962.md): FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c (CVSS 4.9)
- [CVE-2025-59734](https://cve.now/CVE-2025-59734.md): Heap-buffer-overflow write in FFmpeg SANM process\_ftch (CVSS 8.7)
- [CVE-2025-59733](https://cve.now/CVE-2025-59733.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 8.7)
- [CVE-2025-59732](https://cve.now/CVE-2025-59732.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 8.7)
- [CVE-2025-59731](https://cve.now/CVE-2025-59731.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 6.9)
- [CVE-2025-59730](https://cve.now/CVE-2025-59730.md): Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old\_codec48 (CVSS 5.7)
- [CVE-2025-59729](https://cve.now/CVE-2025-59729.md): Heap-buffer-overflow read in FFmpeg DHAV get\_duration (CVSS 5.7)
- [CVE-2025-59728](https://cve.now/CVE-2025-59728.md): Heap-buffer-overflow write in FFmpeg MDASH resolve\_content\_path (CVSS 8.7)
- [CVE-2025-9951](https://cve.now/CVE-2025-9951.md): Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000 (CVSS 7.2)
- [CVE-2025-0518](https://cve.now/CVE-2025-0518.md): Unchecked sscanf return value which leads to memory data leak (CVSS 4.8)
- [CVE-2022-2566](https://cve.now/CVE-2022-2566.md): Heap-memory write in FFMPEG (CVSS 9.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ffmpeg
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.