Ffmpeg

...

We need to produce a JSON object with specific fields based on the provided CVE data. The user wants a multi-source synthesis. We have the CVE description, CVSS vector (CVSS 4.0), EPSS, patch info, CPE, tags, references, etc. Let's extract relevant details: CVE ID: CVE-2026-66040 Description: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. Remote attackers can supply a crafted PNG image with a malicious eXIf chunk. Attackers craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution. CVSS Score: 8.7, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (with other fields as X). So base score 8.7, high impact, user interaction required (UI:P). Attack vector network, low complexity, no privileges required. CWE: CWE-122 (Heap-based Buffer Overflow) EPSS: 0.55% (43rd percentile) – relatively low exploitation probability. Patch: Available from vendor (commit b506faf). Also EUVD says patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc Reported by: VulnCheck CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (all versions prior to fix) Tags: Heap Overflow, Buffer Overflow, RCE, Canonical, Ffmpeg ENISA EUVD ID: EUVD-2026-48742, affected versions: FFmpeg 0 ≤8.1.2, patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc References: pull request, commit, VulnCheck advisory, vuldb advisory. Now we need to fill each field. product_name: "FFmpeg" (primary product, 1-3 words) summary: Start with impact verb and product. Impact: heap out-of-bounds write in PNG/APNG encoder, leading to heap corruption, crash, potential RCE. Affected: FFmpeg through

Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).

We need to analyze CVE-2026-66038 based on the provided multi-source intelligence and generate a comprehensive JSON analysis with specific fields. The user emphasizes synthesizing data, not just paraphrasing the description, and including details from CVSS, EPSS, KEV (not present, no KEV mentioned, so not actively exploited), POC (not explicitly mentioned, so no POC), SSVC, etc. Also need to output a valid JSON with plain text paragraphs. Let's extract the data provided: CVE ID: CVE-2026-66038 Description: FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services. CVSS Score: 7.1 (CVSS 4.0 shown, base score 7.1) CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-908 (Use of Uninitialized Resource) EPSS Score: 0.26% (percentile 17%) Patch: Available from vendor Reported by: VulnCheck (source of advisory) CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (so all versions up through something, likely prior to fix) Tags: Information Disclosure, Ffmpeg SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-48740 Affected versions (EUVD): ["FFmpeg patch: 86708357d126af84c16f80d9c57335d1e8c845c5", "FFmpeg 0 ≤8.1.2"] (so versions 0 to 8.1.2 inclusive, fixed in commit 86708357...) References: [cveorg] (None) https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626 (likely the merge request) [cveorg] (patch) https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c (patch commit e7cbfd1... this might be the fix commit? The description says "fixed in commit 8670835", but the provided patch commit in references is e7cbfd1... possibly the same? Or 8670835 might be a short hash. The EUVD lists "FFmpeg patch: 86708357d126af84c16f80d9c57335d1e8c845c5", so that's the same. So patch commit is available.) [cveorg] (None) https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c (VulnCheck advisory) [vuldb] (advisory) https://vuldb.com/vuln/383018 (another advisory) No KEV mention, so exploitation status: none (according to SSVC: Exploitation: none). Also EPSS is low (0.00026 probability, 17th percentile). So no active exploitation. Product name: "FFmpeg" – the primary affected product. Now, generate each field. Field: product_name: "FFmpeg" (1-3 words, that's fine) Field: summary: 2-3 sentence plain-language synthesis. Do not copy description. Start with specific impact and product. Exploit: information disclosure via uninitialized heap memory in LCL/ZLIB decoder. What attacker can do: leak uninitialized heap memory, including pointer bytes, potentially defeating ASLR. Affected: FFmpeg versions through 8.1.2. Not actively exploited (no KEV), POC? VulnCheck advisory may detail, but we don't have explicit POC status. From tags, it's Information Disclosure. So we can say: "Information disclosure in FFmpeg through 8.1.2's LCL/ZLIB decoder allows remote attackers to leak uninitialized heap memory, including allocator metadata, by providing a specially crafted ZLIB stream that inflates to fewer bytes than expected, potentially enabling ASLR bypass in media processing services. The flaw arises because zlib_decomp() treats short decompression as non-fatal and proceeds to copy the full allocated frame buffer, exposing sensitive memory contents." That's good, no copied description. Not actively exploited, no known POC. Mention EPSS low. Field: technical_context: Underlying technology: FFmpeg's libavcodec/lcldec.c, LCL/ZLIB video decoder, zlib decompression. CWE-908 use of uninitialized resource. CPE: ffmpeg:ffmpeg all versions up to 8.1.2. Explain the root cause: When zlib inflate returns fewer bytes than frame size, the decompressed buffer contains uninitialized heap memory beyond the inflated data. The code does not check for short decompression (non-fatal) and continues to RGB24 conversion, which copies the entire frame rows from that buffer, leading to disclosure. Mention the commit fix: 8670835 which likely adds a check to abort on short decompression or zero-fills the rest. Educational: highlight how memory safety issue arises from mixing expected size with actual decompressed size. "The LCL/ZLIB decoder in FFmpeg uses zlib to decompress LCL video frames. In the zlib_decomp() function, the inflated output may be shorter than allocated if the stream terminates early, but the code does not treat this as an error. The subsequent RGB24 conversion routine then copies the full frame height rows from the allocation buffer using the original frame dimensions, thereby reading beyond the valid decompressed data into uninitialized heap memory. The CWE-908 classification indicates use of uninitialized resource. The fix (commit 86708357d126) likely checks the decompressed size against the expected frame size and either errors out or zero-fills the remainder." Field: risk_assessment: Use all signals. CVSS 4.0 vector: AV:N (network), AC:L, AT:N, PR:N, UI:P (passive user interaction, victim must process media file), VC:H (high confidentiality impact on vulnerable system, i.e., information disclosure), VI:N, VA:N, SC:N etc. So network exploitable with no privileges, but requires user interaction (UI:P meaning passive? In CVSS 4.0, UI:P means passive user: the victim must open or process the crafted media file). So it's not a fully automated network worm; it requires user action (opening file). EPSS: 0.26%, low probability. SSVC: Exploitation none, Automatable no, Technical Impact partial. So overall risk: low exploitation likelihood, but impact is medium (information disclosure, potential ASLR bypass). SSVC says "none" for exploitation, so no known active use. Automatable: no, meaning manual effort needed, likely due to need for crafted file and social engineering. So real risk is low for most environments, but could be concerning for long-lived media processing services that automatically process untrusted content. I'll note that CVSS 4.0 base score 7.1 (High) but without exploitation activity, it's a moderate priority. The UI:P and lack of automatable suggest that it's not wormable, reducing emergency. "Although CVSS 4.0 scores 7.1 (High) due to network vector and high confidentiality impact, the EPSS probability is very low (0.26%, 17th percentile), and SSVC ratings indicate no known exploitation and lack of automatable attack vector. The passive user interaction requirement (UI:P) means an attacker must deliver a malicious media file and have it processed. This vulnerability is likely a low real-world priority for most organizations unless they operate services that automatically process untrusted video streams in FFmpeg-based pipelines. The potential impact is partial (ASLR bypass only, not remote code execution)." Mention that CVSS vector is 4.0, not 3.1, so we need to interpret accordingly. No contradictory signals. Field: affected_products: Write paragraph with version range and links. "FFmpeg versions 0 through 8.1.2 are affected. The vulnerability is fixed in commit 86708357d126af84c16f80d9c57335d1e8c845c5 (merged in pull request #23626) and will be included in subsequent releases. Vendor advisory available at VulnCheck: https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c and additional details at https://vuldb.com/vuln/383018." I can include CPE string? Might be too technical, but mention product. Field: remediation: Patch is available as commit 86708357d126 (e7cbfd1c... reference commit). The primary remediation is to upgrade to a version containing that fix. Since the fix is not yet in a tagged release (as per description "through 8.1.2, fixed in commit"), it may be only in git. I should state: "Upgrade to a build that includes commit 86708357d126af84c16f80d9c57335d1e8c845c5 or later. At the time of writing, the fix is available in the FFmpeg Git repository (pull request #23626, commit e7cbfd1c507b57a806a5825b87d609963e862c8c) but may not yet be in a formal release. Apply the patch manually or update from the development branch. As a workaround, avoid processing untrusted LCL/ZLIB video streams, or disable the LCL decoder if not needed (e.g., using -vcodec copy and a decoder exclusion list). However, disabling may break functionality for legitimate files. No specific configuration-based mitigation is available; the root cause is in the code logic." Will note that side effect of disabling decoder is loss of support for LCL format. Field: exploit_scenario: Realistic attack: Attacker crafts a malicious LCL video file with a truncated zlib stream and delivers it to a victim (e.g., via a malicious website, email attachment, or uploaded to a media processing service). When FFmpeg processes the file, the decoder leaks uninitialized heap memory into the decoded frame, which the attacker can later observe (e.g., in a video output or through a service that returns frames). The leaked memory may contain pointers that help bypass ASLR in subsequent exploit chains. POC availability not confirmed from input; assume none. Say "A proof-of-concept exploit likely exists given the detailed technical analysis from VulnCheck, but no public exploit has been identified in this analysis." Actually the input didn't explicitly confirm POC, but VulnCheck advisory may include technical details. To be safe, I'll phrase: "Detailed exploitation techniques have been described by VulnCheck; however, no exploit code is confirmed publicly available. An attacker would need to..." That's okay. Field: exploitation_conditions: According to description, the vulnerability is triggered when processing an LCL/ZLIB video stream that is valid zlib but inflates to fewer bytes than the expected frame size. So attacker needs to supply a specially crafted video file. The target must process it using FFmpeg, with the lcldec decoder active. No authentication required to deliver the file (network vector, PR:N). But interaction required: victim or service must open the media file (UI:P). The condition is specifically: the LCL/ZLIB decoder must be enabled (it is by default in FFmpeg). No advanced configuration needed. So I'll state: "Exploitation requires the victim or processing service to decode a crafted LCL video file using FFmpeg with the lcldec decoder, which is enabled by default. The attack is unauthenticated remotely but needs passive user interaction (opening or processing the media file). No special configuration beyond default FFmpeg build is

Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.

Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).

Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.

Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.

Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.

Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.

Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.

Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).

Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.

Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.

Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.

Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. [CVSS 5.3 MEDIUM]

ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in FFmpeg up to 7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.

Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.

A flaw was found in FFmpeg's DASH playlist support. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

A flaw was found in FFmpeg. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

A flaw was found in FFmpeg's HLS demuxer. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.

FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg n6.1.1 is Integer Overflow. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.

FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. Rated medium severity (CVSS 5.3).

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

A vulnerability classified as problematic was found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

A vulnerability classified as problematic has been found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

A heap out-of-bounds memory write exists in FFMPEG since version 5.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Uninitialized Resource vulnerability could allow attackers to access uninitialized memory causing crashes or information disclosure.

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.