Ffmpeg vulnerabilities
181 CVEs and advisories name Ffmpeg as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125180FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags
- CVE-2026-125179FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder
- CVE-2026-125178FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions
- CVE-2026-125177FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder
- CVE-2026-125176FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder
- CVE-2026-125175FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder
- CVE-2026-125174FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()
- CVE-2026-125173FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper
- CVE-2026-125172FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length
- CVE-2026-125171FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c
- CVE-2026-125170FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()
- CVE-2026-125104FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c
- CVE-2026-125103FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder
- CVE-2026-125102FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
- CVE-2026-125101FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure
- CVE-2026-125100FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count
- CVE-2026-125099FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder
- CVE-2026-125098FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk
- CVE-2026-125097FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
- CVE-2026-125096FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder
- CVE-2026-125095FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure
- CVE-2026-125073FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder
- CVE-2026-125072FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder
- CVE-2026-125071FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder
- CVE-2026-125070FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder
- CVE-2026-125069FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder
- CVE-2026-125068FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder
- CVE-2026-125067FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()
- CVE-2026-125066FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder
- CVE-2026-125065FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c