FF
Product
FFmpeg
533
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 145Medium 146Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-125018 | 5.5 | Jun 19 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125016 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125014 | 5.5 | Jun 18 | A vulnerability classified as problematic was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125013 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125012 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125010 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125009 | 5.5 | Jun 18 | A vulnerability classified as problematic has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125008 | 5.5 | Jun 18 | A vulnerability classified as problematic has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125007 | 5.5 | Jun 18 | A vulnerability classified as problematic was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125006 | 5.5 | Jun 18 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125005 | 5.5 | Jun 18 | A vulnerability, which was classified as problematic, was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125004 | 5.5 | Jun 18 | A vulnerability has been found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125003 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125002 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2022-1475 | 5.5 | May 2 | An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file Affected: 4.2 before 4.4.2; 5.0 |
| CVE-2020-23906 | 5.5 | Nov 10 | FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity Affected: 4.2 |
| CVE-2021-3566 | 5.5 | Aug 5 | Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it Affected: before 4.3 |
| CVE-2021-38114 | 5.5 | Aug 4 | libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868 Affected: 4.4 |
| CVE-2020-13904 | 5.5 | Jun 7 | FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is… Affected: 2.8; 4.2.3 |
| CVE-2015-1208 | 5.5 | Jan 9 | Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack… Affected: before 2.4.6 |
| CVE-2016-9561 | 5.5 | Dec 23 | The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed… Affected: through 3.2 |
| CVE-2016-8595 | 5.5 | Dec 23 | The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file Affected: through 3.1.4 |
| CVE-2016-7905 | 5.5 | Dec 23 | The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file Affected: through 3.1.3 |
| CVE-2016-7785 | 5.5 | Dec 23 | The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file Affected: through 3.1.3 |
| CVE-2016-7562 | 5.5 | Dec 23 | The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file Affected: through 3.1.3 |
| CVE-2016-7555 | 5.5 | Dec 23 | The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure Affected: through 3.1.3 |
| CVE-2016-7122 | 5.5 | Dec 23 | The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure Affected: through 3.1.3 |
| CVE-2016-6881 | 5.5 | Dec 23 | The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file Affected: through 3.1.2 |
| CVE-2016-1898 | 5.5 | Jan 15 | FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2016-1897 | 5.5 | Jan 15 | FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2026-107698 | 5.4 | Oct 8 | FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling Affected: before 7.1.4; 8.0 before 8.0.2 |
| CVE-2025-69693 | 5.4 | Mar 16 | Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c) Affected: 8.0; 8.0.1 |
| CVE-2024-55069 | 5.3 | May 2 | ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c Affected: 7.1 |
| CVE-2025-0518 | 5.3 | Jan 16 | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable Affected: 7.1 |
| CVE-2023-6604 | 5.3 | Jan 6 | Ffmpeg: hls xbin demuxer dos amplification in ffmpeg Affected: 2.0 through 6.0 |
| CVE-2023-6602 | 5.3 | Dec 31 | Ffmpeg: improper handling of input format in tty demuxer of ffmpeg Affected: 2.0 through 6.0 |
| CVE-2024-36619 | 5.3 | Nov 29 | FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a… Affected: 6.1.1 |
| CVE-2024-31585 | 5.3 | Apr 17 | FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c Affected: 5.1 before 7.0 |
| CVE-2022-3341 | 5.3 | Jan 12 | A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file Affected: before 5.0.3 |
| CVE-2026-107660 | 4.8 | Oct 8 | FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts Affected: before 8.1.3; 9.0 before 9.0.2 |
| CVE-2026-107678 | 4.7 | Oct 8 | FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes Affected: through 9.0.2 |
| CVE-2026-107677 | 4.7 | Oct 8 | FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media Affected: through 9.0.2 |
| CVE-2023-6601 | 4.7 | Jan 6 | Ffmpeg: hls unsafe file extension bypass in ffmpeg Affected: 2.0 through 6.0 |
| CVE-2026-107697 | 4.3 | Oct 8 | FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist() Affected: before 8.1.3 |
| CVE-2026-90816 | 4.3 | Sep 14 | FFmpeg Duration hlsproto.c parse_playlist denial of service Affected: 8.0.* |
| CVE-2023-50007 | 4.0 | Apr 19 | FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component Affected: 6.1 before 7.0 |
The 500 most important CVEs for this product (exploited first, then by severity)