Ffmpeg
Monthly
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
Malformed HEIF image-grid files can trigger a signed integer overflow in FFmpeg before 9.0, causing memory corruption or crashes when width/height fields from a crafted ispe box exceed INT_MAX. All FFmpeg versions before 9.0 are affected, particularly deployments that process HEIF/HEIC images, such as transcoding or thumbnailing services. The independent assessment is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker can trigger it if a crafted file is processed through a local path, though user interaction is required; no public exploit identified at time of analysis, and EPSS is low at 0.11% (percentile 1%).
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
...
Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.
Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).
Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.
Heap memory disclosure in FFmpeg's Huffyuv decoder affects builds from 2.3 through 9.0.2: when a crafted Huffyuv (FFVHuff/HuffYUV) video in packed BGR24 or BGRA pixel format ends its entropy data early, decode_slice() adds uninitialized s->temp[0] bytes into the decoded frame, so heap contents are written into output pixels. The trigger is local with passive user interaction (CVSS:4.0/AV:L/UI:P, PR:N), and impact is confidentiality-only - no code execution, no crash, no integrity effect - and the attacker must be able to observe the decoded output to actually recover the leaked bytes. A vendor fix exists as an upstream PR/commit and the vuln.today decision label is this_month, indicating moderate rather than emergency priority; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stack memory disclosure in FFmpeg 4.4 through 9.0.2 occurs in the niche CDXL decoder: when a crafted type-0 CDXL file is decoded in HAM6 or HAM8 mode, pixel values can index palette slots that import_palette() never populated, and those uninitialized stack bytes - including pointer fragments - are written into the BGR24 output frame. An attacker who can get a victim to open or process such a file, and who can observe the resulting decoded frames, may recover residual process memory; no authentication is required, but the assessed vector is local with passive user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is limited to confidentiality of data that is actually returned to the attacker. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the vendor fix is upstreamed as a commit/PR rather than a confirmed tagged release.
FFmpeg 0.10 through 9.0.2 can leak heap memory when decoding a deliberately truncated 1-bit or 4-bit paletted Sun Raster (.ras/.sun) image. The bug is a use of uninitialized resource (CWE-908) in sunrast_decode_frame(): the temporary bitmap is never cleared, so when it is expanded into PAL8 pixels the decoded frame can contain stale heap bytes such as allocator words. Impact is confidentiality-only and requires the victim to process the crafted file and for the attacker to observe the decoded output; there is no public exploit identified at time of analysis, and the vendor has published upstream fix commits.
Heap memory disclosure in FFmpeg's PCX decoder affects versions 2.1 through 9.0.2: a crafted PCX image whose RLE-encoded scanline data terminates early causes pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into the visible decoded pixels, leaking heap bytes to whoever receives the output image. Impact is confidentiality-only (no code execution, no write, no denial of service) and the assessed 3.1 vector is AV:L/AC:L/PR:N/UI:R, meaning the crafted file must reach a decode path - locally or through an automated service - before the leak occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is concentrated in media transcoders, thumbnail generators and upload-processing pipelines that automatically decode untrusted PCX input, and an upstream fix commit is available.
An information disclosure flaw in FFmpeg's Go2Meeting (G2M) decoder lets an attacker who supplies a crafted G2M3/G2M4 stream read uninitialized stack memory, because out-of-range Kempf palette indices cause kempf_restore_buf() to copy stale stack bytes - potentially pointers or stack guards - into the decoded frame. FFmpeg 2.0 through 9.0.2 are affected; exploitation requires the victim or an automated media pipeline to decode the crafted file and a way to observe the resulting decoded output, and it grants no integrity or availability impact. The upstream fix (commit edad2d0dafcf44fa315eab716fd0183ce808053b, PR 24858) adds a col >= npal bounds check; no public exploit code has been identified at time of analysis and CVE-2026-120243 is not in CISA KEV.
Path traversal in FFmpeg 5.0 through 9.0.2's IMF demuxer allows an unauthenticated remote attacker to make the demuxer open files outside an IMF package by embedding '..' or absolute paths in ASSETMAP Path elements, enabling local file existence and size probing plus server-side requests. The attacker must supply a crafted IMF package that the target opens or demuxes (UI:P), so exposure is highest in automated media-ingestion and transcoding services that process untrusted packages. This is a medium-severity information-disclosure/SSRF issue; no public exploit identified at time of analysis.
Denial of service in FFmpeg build N-119856-gbe46370941 occurs when the H.264 decoding path processes a crafted media file and dereferences a NULL pointer in avpriv_h264_has_num_reorder_frames, crashing the affected process. The CVSS 3.1 score is 7.5 with availability-only impact (C:N/I:N/A:H) and an AV:N/AC:L/PR:N/UI:N vector, making it remotely reachable without privileges or user interaction in automated decoding pipelines; services that automatically ingest untrusted media are the highest-risk exposure, while manual-open scenarios add user interaction not reflected in the vector. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to yes.
Server-side request forgery in FFmpeg's RTSP handling (ff_rtsp_connect() in libavformat/rtsp.c) lets a malicious RTSP server answer with an RTSP 3xx redirect whose Location header points to an internal host and port under a different scheme, which the library then follows without validating the target - defeating the -protocol_whitelist control. Affected builds are FFmpeg before 7.1.4 and the 8.0.x line before 8.0.2; exploitation is unauthenticated per the CVSS 4.0 vector (PR:N) but requires a victim application or user to process the attacker-controlled rtsp:// source, and impact is bounded to probing/reaching internal services rather than data exfiltration or code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; vendor patches are available in 7.1.4 and 8.0.2.
Information disclosure in FFmpeg before 8.1.3 occurs when the HLS demuxer fails to enforce protocol and allowed_extensions restrictions while opening child playlists, allowing an attacker-supplied master playlist to make FFmpeg access disallowed protocols or non-multimedia local files. The issue requires a victim application or service to ingest the crafted playlist (unauthenticated attack with user interaction or an automated pipeline) and is limited to confidentiality impact; no public exploit identified at time of analysis. Vendor-released patch: FFmpeg 8.1.3.
Denial-of-service in FFmpeg through 9.0.2: demuxing a crafted MP4/MOV file containing tens of thousands of minimal pssh boxes triggers uncontrolled recursion in av_encryption_init_info_free(), exhausting the stack and crashing the process, with additional quadratic CPU consumption. No authentication or privileges are required (PR:N), but exploitation is local (AV:L), demands passive user interaction (UI:P) to feed the file into an FFmpeg-based pipeline, and is high complexity (AC:H). Impact is availability-only; there is no code execution or data exposure. The issue is tracked as CWE-674 (uncontrolled recursion), and an upstream fix is proposed in FFmpeg PR 24593; no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in FFmpeg through 9.0.2 allows a crafted MPEG-DASH manifest whose SegmentTemplate element declares an empty media attribute (media="") to drive the DASH demuxer into an unbounded loop, consuming CPU indefinitely and hanging the process that is decoding the stream. Per the supplied CVSS 4.0 vector the issue is unauthenticated (PR:N) but requires user interaction (UI:P), because a victim or a host application must actively open or stream the attacker-supplied .mpd manifest; impact is confined to availability, with no confidentiality or integrity effect, and our independent assessment characterizes it as a medium-severity availability-only flaw (CWE-835) rather than a critical one. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the vulnerable source paths are public and an upstream fix is already committed.
Uninitialized memory disclosure in FFmpeg's HDR10+ dynamic metadata serializer (av_dynamic_hdr_plus_to_t35()) lets crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata cause up to three bytes of stale process memory to be written into remuxed or transcoded output files. All FFmpeg versions through 9.0.2 are affected; CVSS 4.0 scores this 4.8 (AV:L/UI:P/C:L) and the independent assessment concurs at CVSS 3.1 4.8 with only confidentiality impact, because the leak is bounded to a few bytes, requires the victim to actively process the file, and gives the attacker no control over the leaked contents. There is no public exploit identified at time of analysis and no CISA KEV listing, but an upstream fix commit and pull request are already available, making this an internally consistent low-to-moderate priority remediation item rather than an urgent one.
FFmpeg 9.0.2 and earlier, when compiled with libssh support, fail to verify SSH host keys in the sftp:// protocol handler, allowing an on-path attacker to impersonate a legitimate SFTP server and capture passwords embedded in sftp:// URLs, serve forged media, or receive uploaded output. The issue is conditional rather than broadly exploitable: it only affects applications that actually invoke the sftp:// handler with password-bearing URLs, and the attacker must already hold a privileged man-in-the-middle position (ARP, DNS, or routing spoofing) at the moment of connection. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Hostname verification bypass in FFmpeg's mbedTLS TLS backend (tls_open() in libavformat/tls_mbedtls.c) lets a network man-in-the-middle holding any certificate from a trusted CA intercept, read and tamper with streams that FFmpeg retrieves from IP-literal URLs over https, rtmps or tls, affecting builds before 8.1.3 and 9.x before 9.0.2. According to the CVSS vector the attack is unauthenticated (PR:N) and requires no user interaction (UI:N), but the high attack complexity and Present attack requirement (AT:P) mean the attacker must already occupy a MITM position on the path, and the flaw only triggers on mbedTLS-linked builds and IP-literal targets because hostname checks still run for DNS names; impact is limited to confidentiality and integrity of the stream, with no availability or code-execution effect (CVSS 3.1 4.0-equivalent severity ~6.3 medium, CWE-297). No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though vendor patches are available.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Buffer overflow in FFmpeg v.7.0 and later within the libavformat/iamf_writer.c component allows an attacker to crash the process by supplying a crafted IAMF (Immersive Audio Model and Formats) file, resulting in a denial of service. The flaw, rooted in improper bounds checking during extradata padding operations (CWE-120), affects the IAMF audio encoder/writer path introduced alongside IAMF support in FFmpeg 7.0. A patch commit (8439e020) and upstream pull request #22988 are available, though a tagged release incorporating the fix has not been independently confirmed. No public exploit code has been identified and EPSS of 0.17% (7th percentile) reflects low exploitation probability at this time.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Uninitialized heap memory disclosure in FFmpeg's native TIFF decoder (libavcodec/tiff.c) exposes stale heap contents to any party able to retrieve decoded image output. Affected versions span 0.5 through 8.x; FFmpeg 9.0 carries the upstream fix. In server-side media pipelines that accept and return processed TIFF files - transcoding APIs, thumbnail generators, upload handlers - an attacker can craft a structurally valid Deflate-compressed TIFF strip that inflates short, causing the decoder to embed prior heap allocation remnants into the decoded output, potentially leaking sensitive in-process data. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code was identified at time of analysis.
Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.
Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
Ffmpeg contains a vulnerability that allows attackers to a double-free condition, potentially causing FFmpeg or any application using it (CVSS 3.3).
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. [CVSS 5.3 MEDIUM]
Integer overflow in FFmpeg 8.0's libswscale output path (yuv2ya16_X_c_template in libswscale/output.c) lets attacker-controlled media trigger a crash when the YA16 (16-bit luminance + alpha) pixel format is converted through the scaler, producing a denial-of-service condition rather than code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores purely on availability impact, so affected deployments are those that process untrusted media - particularly automated server-side transcoding pipelines - while interactive desktop users would need to open a crafted file. Only FFmpeg 8.0 is listed as affected via CPE; vendor patch data is available but no public exploit code or confirmed active exploitation was identified at time of analysis.
ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in FFmpeg up to 7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in FFmpeg's DASH playlist support. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in FFmpeg. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in FFmpeg's HLS demuxer. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n6.1.1 is Integer Overflow. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. Rated medium severity (CVSS 5.3).
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability classified as problematic was found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability classified as problematic has been found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
Malformed HEIF image-grid files can trigger a signed integer overflow in FFmpeg before 9.0, causing memory corruption or crashes when width/height fields from a crafted ispe box exceed INT_MAX. All FFmpeg versions before 9.0 are affected, particularly deployments that process HEIF/HEIC images, such as transcoding or thumbnailing services. The independent assessment is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker can trigger it if a crafted file is processed through a local path, though user interaction is required; no public exploit identified at time of analysis, and EPSS is low at 0.11% (percentile 1%).
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
...
Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.
Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).
Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Denial of service in FFmpeg's libavformat RTP/ASF demuxer (versions 0.6.3 through 8.1.2) lets remote attackers exhaust CPU by delivering a crafted RTP/ASF stream. The rtp_asf_fix_header function in rtpdec_asf.c omits a minimum-chunksize check while iterating ASF objects, so a chunksize below the 24-byte ASF object header minimum leaves the loop pointer static and spins forever. There is no public exploit identified at time of analysis, and the flaw impacts availability only (no code execution or data exposure); it was reported by VulnCheck with an upstream fix committed.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.
Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.
Heap memory disclosure in FFmpeg's Huffyuv decoder affects builds from 2.3 through 9.0.2: when a crafted Huffyuv (FFVHuff/HuffYUV) video in packed BGR24 or BGRA pixel format ends its entropy data early, decode_slice() adds uninitialized s->temp[0] bytes into the decoded frame, so heap contents are written into output pixels. The trigger is local with passive user interaction (CVSS:4.0/AV:L/UI:P, PR:N), and impact is confidentiality-only - no code execution, no crash, no integrity effect - and the attacker must be able to observe the decoded output to actually recover the leaked bytes. A vendor fix exists as an upstream PR/commit and the vuln.today decision label is this_month, indicating moderate rather than emergency priority; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stack memory disclosure in FFmpeg 4.4 through 9.0.2 occurs in the niche CDXL decoder: when a crafted type-0 CDXL file is decoded in HAM6 or HAM8 mode, pixel values can index palette slots that import_palette() never populated, and those uninitialized stack bytes - including pointer fragments - are written into the BGR24 output frame. An attacker who can get a victim to open or process such a file, and who can observe the resulting decoded frames, may recover residual process memory; no authentication is required, but the assessed vector is local with passive user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is limited to confidentiality of data that is actually returned to the attacker. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the vendor fix is upstreamed as a commit/PR rather than a confirmed tagged release.
FFmpeg 0.10 through 9.0.2 can leak heap memory when decoding a deliberately truncated 1-bit or 4-bit paletted Sun Raster (.ras/.sun) image. The bug is a use of uninitialized resource (CWE-908) in sunrast_decode_frame(): the temporary bitmap is never cleared, so when it is expanded into PAL8 pixels the decoded frame can contain stale heap bytes such as allocator words. Impact is confidentiality-only and requires the victim to process the crafted file and for the attacker to observe the decoded output; there is no public exploit identified at time of analysis, and the vendor has published upstream fix commits.
Heap memory disclosure in FFmpeg's PCX decoder affects versions 2.1 through 9.0.2: a crafted PCX image whose RLE-encoded scanline data terminates early causes pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into the visible decoded pixels, leaking heap bytes to whoever receives the output image. Impact is confidentiality-only (no code execution, no write, no denial of service) and the assessed 3.1 vector is AV:L/AC:L/PR:N/UI:R, meaning the crafted file must reach a decode path - locally or through an automated service - before the leak occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is concentrated in media transcoders, thumbnail generators and upload-processing pipelines that automatically decode untrusted PCX input, and an upstream fix commit is available.
An information disclosure flaw in FFmpeg's Go2Meeting (G2M) decoder lets an attacker who supplies a crafted G2M3/G2M4 stream read uninitialized stack memory, because out-of-range Kempf palette indices cause kempf_restore_buf() to copy stale stack bytes - potentially pointers or stack guards - into the decoded frame. FFmpeg 2.0 through 9.0.2 are affected; exploitation requires the victim or an automated media pipeline to decode the crafted file and a way to observe the resulting decoded output, and it grants no integrity or availability impact. The upstream fix (commit edad2d0dafcf44fa315eab716fd0183ce808053b, PR 24858) adds a col >= npal bounds check; no public exploit code has been identified at time of analysis and CVE-2026-120243 is not in CISA KEV.
Path traversal in FFmpeg 5.0 through 9.0.2's IMF demuxer allows an unauthenticated remote attacker to make the demuxer open files outside an IMF package by embedding '..' or absolute paths in ASSETMAP Path elements, enabling local file existence and size probing plus server-side requests. The attacker must supply a crafted IMF package that the target opens or demuxes (UI:P), so exposure is highest in automated media-ingestion and transcoding services that process untrusted packages. This is a medium-severity information-disclosure/SSRF issue; no public exploit identified at time of analysis.
Denial of service in FFmpeg build N-119856-gbe46370941 occurs when the H.264 decoding path processes a crafted media file and dereferences a NULL pointer in avpriv_h264_has_num_reorder_frames, crashing the affected process. The CVSS 3.1 score is 7.5 with availability-only impact (C:N/I:N/A:H) and an AV:N/AC:L/PR:N/UI:N vector, making it remotely reachable without privileges or user interaction in automated decoding pipelines; services that automatically ingest untrusted media are the highest-risk exposure, while manual-open scenarios add user interaction not reflected in the vector. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to yes.
Server-side request forgery in FFmpeg's RTSP handling (ff_rtsp_connect() in libavformat/rtsp.c) lets a malicious RTSP server answer with an RTSP 3xx redirect whose Location header points to an internal host and port under a different scheme, which the library then follows without validating the target - defeating the -protocol_whitelist control. Affected builds are FFmpeg before 7.1.4 and the 8.0.x line before 8.0.2; exploitation is unauthenticated per the CVSS 4.0 vector (PR:N) but requires a victim application or user to process the attacker-controlled rtsp:// source, and impact is bounded to probing/reaching internal services rather than data exfiltration or code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; vendor patches are available in 7.1.4 and 8.0.2.
Information disclosure in FFmpeg before 8.1.3 occurs when the HLS demuxer fails to enforce protocol and allowed_extensions restrictions while opening child playlists, allowing an attacker-supplied master playlist to make FFmpeg access disallowed protocols or non-multimedia local files. The issue requires a victim application or service to ingest the crafted playlist (unauthenticated attack with user interaction or an automated pipeline) and is limited to confidentiality impact; no public exploit identified at time of analysis. Vendor-released patch: FFmpeg 8.1.3.
Denial-of-service in FFmpeg through 9.0.2: demuxing a crafted MP4/MOV file containing tens of thousands of minimal pssh boxes triggers uncontrolled recursion in av_encryption_init_info_free(), exhausting the stack and crashing the process, with additional quadratic CPU consumption. No authentication or privileges are required (PR:N), but exploitation is local (AV:L), demands passive user interaction (UI:P) to feed the file into an FFmpeg-based pipeline, and is high complexity (AC:H). Impact is availability-only; there is no code execution or data exposure. The issue is tracked as CWE-674 (uncontrolled recursion), and an upstream fix is proposed in FFmpeg PR 24593; no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in FFmpeg through 9.0.2 allows a crafted MPEG-DASH manifest whose SegmentTemplate element declares an empty media attribute (media="") to drive the DASH demuxer into an unbounded loop, consuming CPU indefinitely and hanging the process that is decoding the stream. Per the supplied CVSS 4.0 vector the issue is unauthenticated (PR:N) but requires user interaction (UI:P), because a victim or a host application must actively open or stream the attacker-supplied .mpd manifest; impact is confined to availability, with no confidentiality or integrity effect, and our independent assessment characterizes it as a medium-severity availability-only flaw (CWE-835) rather than a critical one. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the vulnerable source paths are public and an upstream fix is already committed.
Uninitialized memory disclosure in FFmpeg's HDR10+ dynamic metadata serializer (av_dynamic_hdr_plus_to_t35()) lets crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata cause up to three bytes of stale process memory to be written into remuxed or transcoded output files. All FFmpeg versions through 9.0.2 are affected; CVSS 4.0 scores this 4.8 (AV:L/UI:P/C:L) and the independent assessment concurs at CVSS 3.1 4.8 with only confidentiality impact, because the leak is bounded to a few bytes, requires the victim to actively process the file, and gives the attacker no control over the leaked contents. There is no public exploit identified at time of analysis and no CISA KEV listing, but an upstream fix commit and pull request are already available, making this an internally consistent low-to-moderate priority remediation item rather than an urgent one.
FFmpeg 9.0.2 and earlier, when compiled with libssh support, fail to verify SSH host keys in the sftp:// protocol handler, allowing an on-path attacker to impersonate a legitimate SFTP server and capture passwords embedded in sftp:// URLs, serve forged media, or receive uploaded output. The issue is conditional rather than broadly exploitable: it only affects applications that actually invoke the sftp:// handler with password-bearing URLs, and the attacker must already hold a privileged man-in-the-middle position (ARP, DNS, or routing spoofing) at the moment of connection. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Hostname verification bypass in FFmpeg's mbedTLS TLS backend (tls_open() in libavformat/tls_mbedtls.c) lets a network man-in-the-middle holding any certificate from a trusted CA intercept, read and tamper with streams that FFmpeg retrieves from IP-literal URLs over https, rtmps or tls, affecting builds before 8.1.3 and 9.x before 9.0.2. According to the CVSS vector the attack is unauthenticated (PR:N) and requires no user interaction (UI:N), but the high attack complexity and Present attack requirement (AT:P) mean the attacker must already occupy a MITM position on the path, and the flaw only triggers on mbedTLS-linked builds and IP-literal targets because hostname checks still run for DNS names; impact is limited to confidentiality and integrity of the stream, with no availability or code-execution effect (CVSS 3.1 4.0-equivalent severity ~6.3 medium, CWE-297). No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though vendor patches are available.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Out-of-bounds read in FFmpeg's convolution video filter (libavfilter/vf_convolution.c, function setup_3x3) affects releases 4.4.0–4.4.6, 5.1.0–5.1.8, 6.1.0–6.1.4, 7.1.0–7.1.3 and 8.0.0–8.0.1, allowing crafted media input to read past allocated buffers and potentially disclose memory or crash the process. Publicly available exploit code exists via the FFmpeg issue tracker, and the fix commit (8970658472d1 / e24b9820b4) has been published, with corrected releases 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0. Impact is limited: CVSS 2.1, and exploitation requires the non-default convolution filter to be applied to attacker-influenced input, so this is a low-severity hardening issue rather than an urgent patch-now event.
Buffer overflow in FFmpeg v.7.0 and later within the libavformat/iamf_writer.c component allows an attacker to crash the process by supplying a crafted IAMF (Immersive Audio Model and Formats) file, resulting in a denial of service. The flaw, rooted in improper bounds checking during extradata padding operations (CWE-120), affects the IAMF audio encoder/writer path introduced alongside IAMF support in FFmpeg 7.0. A patch commit (8439e020) and upstream pull request #22988 are available, though a tagged release incorporating the fix has not been independently confirmed. No public exploit code has been identified and EPSS of 0.17% (7th percentile) reflects low exploitation probability at this time.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
Uninitialized heap memory disclosure in FFmpeg's native TIFF decoder (libavcodec/tiff.c) exposes stale heap contents to any party able to retrieve decoded image output. Affected versions span 0.5 through 8.x; FFmpeg 9.0 carries the upstream fix. In server-side media pipelines that accept and return processed TIFF files - transcoding APIs, thumbnail generators, upload handlers - an attacker can craft a structurally valid Deflate-compressed TIFF strip that inflates short, causing the decoder to embed prior heap allocation remnants into the decoded output, potentially leaking sensitive in-process data. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code was identified at time of analysis.
Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.
Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
Ffmpeg contains a vulnerability that allows attackers to a double-free condition, potentially causing FFmpeg or any application using it (CVSS 3.3).
A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. [CVSS 5.3 MEDIUM]
Integer overflow in FFmpeg 8.0's libswscale output path (yuv2ya16_X_c_template in libswscale/output.c) lets attacker-controlled media trigger a crash when the YA16 (16-bit luminance + alpha) pixel format is converted through the scaler, producing a denial-of-service condition rather than code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores purely on availability impact, so affected deployments are those that process untrusted media - particularly automated server-side transcoding pipelines - while interactive desktop users would need to open a crafted file. Only FFmpeg 8.0 is listed as affected via CPE; vendor patch data is available but no public exploit code or confirmed active exploitation was identified at time of analysis.
ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in FFmpeg up to 7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in FFmpeg's DASH playlist support. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in FFmpeg. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in FFmpeg's HLS demuxer. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n6.1.1 is Integer Overflow. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg 7.0 is vulnerable to Buffer Overflow. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. Rated medium severity (CVSS 5.3).
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability classified as problematic was found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability classified as problematic has been found in ffmpeg. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.