FF
Product
FFmpeg
526
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 141Medium 143Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-3964 | 8.1 | Nov 13 | A vulnerability classified as problematic has been found in ffmpeg Affected: 4.4 before 4.4.4; 5.0 before 5.0.3; 5.1 before 5.1.3 |
| CVE-2018-13305 | 8.1 | Jul 5 | In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array… Affected: 4.0.1 |
| CVE-2018-13300 | 8.1 | Jul 5 | In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an… Affected: 4.0.1 |
| CVE-2023-51795 | 8.0 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in… Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2023-50009 | 8.0 | Apr 19 | FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component Affected: 6.1 before 7.0 |
| CVE-2023-49501 | 8.0 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the… Affected: 6.1 |
| CVE-2023-49528 | 8.0 | Apr 12 | Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the… Affected: 6.1 |
| CVE-2026-96611 | 7.8 | Sep 23 | FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c Affected: before 9.0 |
| CVE-2026-75144 | 7.8 | Aug 19 | FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer Affected: before 1cdeb3c4e7f1f8566d846b9b451e01c376398818 |
| CVE-2026-75142 | 7.8 | Aug 19 | FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c Affected: before 9d786e4b5e9b8482651928574de33772aeee7be1 |
| CVE-2026-75141 | 7.8 | Aug 19 | FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing Affected: before acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 |
| CVE-2026-70632 | 7.8 | Aug 6 | FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing Affected: 4.4 before 9.0 |
| CVE-2026-70628 | 7.8 | Aug 6 | FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File Affected: 0.5 before 9.0 |
| CVE-2026-66041 | 7.8 | Jul 24 | FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter Affected: 7.0 through 8.1.2 |
| CVE-2026-66039 | 7.8 | Jul 24 | FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File Affected: through 8.1.2 |
| CVE-2026-65706 | 7.8 | Jul 23 | FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing Affected: 3.0 through 8.1.2 |
| CVE-2026-65705 | 7.8 | Jul 23 | FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame() Affected: 3.4 through 8.1.2 |
| CVE-2026-65704 | 7.8 | Jul 23 | FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder Affected: through 8.1.2 |
| CVE-2026-65703 | 7.8 | Jul 23 | FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder Affected: 2.7 through 8.1.2 |
| CVE-2024-32230 | 7.8 | Jul 1 | FFmpeg 7.0 is vulnerable to Buffer Overflow Affected: 7.0 |
| CVE-2023-51794 | 7.8 | Apr 26 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69 Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2023-51798 | 7.8 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at… Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2023-51793 | 7.8 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2023-51791 | 7.8 | Apr 19 | Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2023-50010 | 7.8 | Apr 19 | FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c… Affected: 6.1 before 7.0 |
| CVE-2023-50008 | 7.8 | Apr 19 | FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component Affected: 6.1 before 7.0 |
| CVE-2024-31582 | 7.8 | Apr 17 | FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c Affected: 6.1 before 7.0 |
| CVE-2023-47470 | 7.8 | Nov 16 | Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary… Affected: 6.1 |
| CVE-2022-2566 | 7.8 | Sep 23 | A heap out-of-bounds memory write exists in FFMPEG since version 5.1 Affected: 5.1 |
| CVE-2014-125024 | 7.8 | Jun 19 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125020 | 7.8 | Jun 19 | A vulnerability has been found in FFmpeg 2.0 and classified as critical Affected: 2.0 |
| CVE-2014-125017 | 7.8 | Jun 18 | A vulnerability classified as critical was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125015 | 7.8 | Jun 18 | A vulnerability classified as critical has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125011 | 7.8 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2020-24995 | 7.8 | Mar 30 | Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local) Affected: 3.1.2 |
| CVE-2017-11719 | 7.8 | Jul 28 | The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have… Affected: through 3.3.2 |
| CVE-2017-11399 | 7.8 | Jul 17 | Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and… Affected: through 3.3.2 |
| CVE-2017-9996 | 7.8 | Jun 28 | The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not… Affected: 2.8; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +28 more |
| CVE-2017-9995 | 7.8 | Jun 28 | libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer… Affected: 3.3 |
| CVE-2017-9994 | 7.8 | Jun 28 | libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows… Affected: before 2.8.12; 3.0 before 3.0.8; 3.1 before 3.1.8; 3.2 before 3.2.5; 3.3 before 3.3.1 |
| CVE-2017-9991 | 7.8 | Jun 28 | Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x… Affected: through 2.8.11; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +17 more |
| CVE-2012-5361 | 7.8 | Mar 20 | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file Affected: through 0.10.15 |
| CVE-2016-7502 | 7.8 | Dec 23 | The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode Affected: through 3.1.3 |
| CVE-2016-7450 | 7.8 | Dec 23 | The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file Affected: through 3.1.3 |
| CVE-2016-6671 | 7.8 | Dec 23 | The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a… Affected: through 3.1.1 |
| CVE-2026-64834 | 7.5 | Jul 22 | FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer Affected: 0.6.3 through 8.1.2; 11d5f475be95d22d5f0692220cc772b116abc632 |
| CVE-2026-30998 | 7.5 | Apr 13 | An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: through 8.0.1 |
| CVE-2026-30997 | 7.5 | Apr 13 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input Affected: through 8.0.1 |
| CVE-2026-30999 | 7.5 | Apr 13 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input Affected: through 8.0.1 |
| CVE-2025-63757 | 7.5 | Dec 18 | Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0 Affected: 8 |
The 500 most important CVEs for this product (exploited first, then by severity)
