Ffmpeg vulnerabilities
181 CVEs and advisories name Ffmpeg as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125064FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder
- CVE-2026-120247FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
- CVE-2026-120246FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
- CVE-2026-120245FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
- CVE-2026-120244FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
- CVE-2026-120243FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
- CVE-2026-120210FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
- CVE-2026-107698FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
- CVE-2026-107697FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
- CVE-2026-107696FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
- CVE-2026-107695FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
- CVE-2026-107678FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
- CVE-2026-107677FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
- CVE-2026-107676FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
- CVE-2026-107675FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
- CVE-2026-107660FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
- CVE-2026-96611FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c.
- CVE-2026-52297FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in lib
- CVE-2026-52296FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
- CVE-2026-52295FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavf
- CVE-2026-75147FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c
- CVE-2026-75146FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c
- CVE-2026-75145FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
- CVE-2026-75144FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
- CVE-2026-75143FFmpeg Heap Buffer Overflow via RIST Protocol Reader
- CVE-2026-75142FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c
- CVE-2026-75141FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing
- CVE-2026-70632FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing
- CVE-2026-70631FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
- CVE-2026-70630FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder