FF
Product
FFmpeg
by Ffmpeg · last CVE Oct 8, 2026
532
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 144Medium 146Low 3
Watch

Add FFmpeg to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-47470
7.8
1%
Nov 16
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary…
Affected: 6.1
CVE-2022-2566
7.8
1%
Sep 23
A heap out-of-bounds memory write exists in FFMPEG since version 5.1
Affected: 5.1
CVE-2014-125024
7.8
1%
Jun 19
A vulnerability was found in FFmpeg 2.0
Affected: 2.0
CVE-2014-125020
7.8
1%
Jun 19
A vulnerability has been found in FFmpeg 2.0 and classified as critical
Affected: 2.0
CVE-2014-125017
7.8
1%
Jun 18
A vulnerability classified as critical was found in FFmpeg 2.0
Affected: 2.0
CVE-2014-125015
7.8
1%
Jun 18
A vulnerability classified as critical has been found in FFmpeg 2.0
Affected: 2.0
CVE-2014-125011
7.8
1%
Jun 18
A vulnerability was found in FFmpeg 2.0
Affected: 2.0
CVE-2020-24995
7.8
1%
Mar 30
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local)
Affected: 3.1.2
CVE-2017-11719
7.8
2%
Jul 28
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have…
Affected: through 3.3.2
CVE-2017-11399
7.8
2%
Jul 17
Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and…
Affected: through 3.3.2
CVE-2017-9996
7.8
2%
Jun 28
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not…
Affected: 2.8; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +28 more
CVE-2017-9995
7.8
2%
Jun 28
libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer…
Affected: 3.3
CVE-2017-9994
7.8
2%
Jun 28
libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows…
Affected: before 2.8.12; 3.0 before 3.0.8; 3.1 before 3.1.8; 3.2 before 3.2.5; 3.3 before 3.3.1
CVE-2017-9991
7.8
2%
Jun 28
Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x…
Affected: through 2.8.11; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +17 more
CVE-2012-5361
7.8
3%
Mar 20
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file
Affected: through 0.10.15
CVE-2016-7502
7.8
1%
Dec 23
The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode
Affected: through 3.1.3
CVE-2016-7450
7.8
1%
Dec 23
The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file
Affected: through 3.1.3
CVE-2016-6671
7.8
2%
Dec 23
The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a…
Affected: through 3.1.1
CVE-2026-64834
7.5
1%
Jul 22
FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
Affected: 0.6.3 through 8.1.2; 11d5f475be95d22d5f0692220cc772b116abc632
CVE-2026-30999
7.5
0%
Apr 13
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input
Affected: through 8.0.1
CVE-2026-30997
7.5
0%
Apr 13
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input
Affected: through 8.0.1
CVE-2026-30998
7.5
0%
Apr 13
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a…
Affected: through 8.0.1
CVE-2025-63757
7.5
0%
Dec 18
Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0
Affected: 8
CVE-2023-6603
7.5
1%
Dec 31
Ffmpeg: null pointer dereference in ffmpeg hls parsing
Affected: 2.0 through 6.0
CVE-2024-31578
7.5
1%
Apr 17
FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function
Affected: before 7.0
CVE-2024-22861
7.5
1%
Jan 27
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module
Affected: 6.1
CVE-2020-36138
7.5
1%
Aug 11
An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS)
Affected: 4.3
CVE-2022-3109
7.5
2%
Dec 16
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference,…
Affected: before 5.0.3
CVE-2021-38291
7.5
3%
Aug 12
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c
Affected: before 4.1.7; 4.2.0 before 4.2.5; 4.3.0 before 4.3.3; 4.4.0 before 4.4.1
CVE-2020-20451
7.5
1%
May 25
Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c
Affected: 4.2
CVE-2020-20450
7.5
1%
May 25
FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service
Affected: 4.2
CVE-2020-21041
7.5
2%
May 24
Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
Affected: 4.1
CVE-2020-35965
7.5
2%
Jan 4
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations
Affected: 4.3.1 before 4.4
CVE-2018-15822
7.5
3%
Aug 23
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure
Affected: through 2.8
CVE-2012-2805
7.5
2%
Aug 28
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service
Affected: 0.10
CVE-2017-11665
7.5
2%
Jul 27
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash)…
Affected: 3.3.2
CVE-2017-9993
7.5
16%
Jun 28
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer…
Affected: before 2.8.12; 3.0 before 3.1.9; 3.2 before 3.2.6; 3.3 before 3.3.2
CVE-2016-6920
7.5
3%
Jan 23
Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via…
Affected: through 3.1.2
CVE-2015-8662
7.3
2%
Dec 24
The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet…
Affected: through 2.8.3
CVE-2023-6605
7.2
0%
Jan 6
Ffmpeg: dash playlist ssrf vulnerability in ffmpeg
Affected: 2.0 through 6.0
CVE-2026-52296
7.1
0%
Sep 13
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c
Affected: before 9.0
CVE-2026-52297
7.1
0%
Sep 13
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c
Affected: before 9.0
CVE-2026-75147
7.1
0%
Aug 19
FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c
Affected: before 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8
CVE-2026-64833
7.1
0%
Jul 22
FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c
Affected: 0.7.1 through 8.1.2; 6f80e2765492700622596af720534cef33dd31b4
Page 3 of 3 · 144 total
The 500 most important CVEs for this product (exploited first, then by severity)