Ffmpeg
Monthly
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
...
Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.
Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).
Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
Buffer overflow in FFmpeg v.7.0 and later within the libavformat/iamf_writer.c component allows an attacker to crash the process by supplying a crafted IAMF (Immersive Audio Model and Formats) file, resulting in a denial of service. The flaw, rooted in improper bounds checking during extradata padding operations (CWE-120), affects the IAMF audio encoder/writer path introduced alongside IAMF support in FFmpeg 7.0. A patch commit (8439e020) and upstream pull request #22988 are available, though a tagged release incorporating the fix has not been independently confirmed. No public exploit code has been identified and EPSS of 0.17% (7th percentile) reflects low exploitation probability at this time.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Uninitialized heap memory disclosure in FFmpeg's native TIFF decoder (libavcodec/tiff.c) exposes stale heap contents to any party able to retrieve decoded image output. Affected versions span 0.5 through 8.x; FFmpeg 9.0 carries the upstream fix. In server-side media pipelines that accept and return processed TIFF files - transcoding APIs, thumbnail generators, upload handlers - an attacker can craft a structurally valid Deflate-compressed TIFF strip that inflates short, causing the decoder to embed prior heap allocation remnants into the decoded output, potentially leaking sensitive in-process data. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code was identified at time of analysis.
Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.
Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
Ffmpeg contains a vulnerability that allows attackers to a double-free condition, potentially causing FFmpeg or any application using it (CVSS 3.3).
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. [CVSS 5.3 MEDIUM]
ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in FFmpeg up to 7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in FFmpeg's DASH playlist support. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in FFmpeg. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in FFmpeg's HLS demuxer. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n6.1.1 is Integer Overflow. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. Rated medium severity (CVSS 5.3).
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability classified as problematic was found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability classified as problematic has been found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
...
Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.
Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).
Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
Buffer overflow in FFmpeg v.7.0 and later within the libavformat/iamf_writer.c component allows an attacker to crash the process by supplying a crafted IAMF (Immersive Audio Model and Formats) file, resulting in a denial of service. The flaw, rooted in improper bounds checking during extradata padding operations (CWE-120), affects the IAMF audio encoder/writer path introduced alongside IAMF support in FFmpeg 7.0. A patch commit (8439e020) and upstream pull request #22988 are available, though a tagged release incorporating the fix has not been independently confirmed. No public exploit code has been identified and EPSS of 0.17% (7th percentile) reflects low exploitation probability at this time.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Uninitialized heap memory disclosure in FFmpeg's native TIFF decoder (libavcodec/tiff.c) exposes stale heap contents to any party able to retrieve decoded image output. Affected versions span 0.5 through 8.x; FFmpeg 9.0 carries the upstream fix. In server-side media pipelines that accept and return processed TIFF files - transcoding APIs, thumbnail generators, upload handlers - an attacker can craft a structurally valid Deflate-compressed TIFF strip that inflates short, causing the decoder to embed prior heap allocation remnants into the decoded output, potentially leaking sensitive in-process data. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code was identified at time of analysis.
Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.
Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
Ffmpeg contains a vulnerability that allows attackers to a double-free condition, potentially causing FFmpeg or any application using it (CVSS 3.3).
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. [CVSS 5.3 MEDIUM]
ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in FFmpeg up to 7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in FFmpeg's DASH playlist support. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in FFmpeg. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in FFmpeg's HLS demuxer. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n6.1.1 is Integer Overflow. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. Rated medium severity (CVSS 5.3).
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability classified as problematic was found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability classified as problematic has been found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.