FF
Product
FFmpeg
533
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 145Medium 146Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30999 | 7.5 | Apr 13 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input Affected: through 8.0.1 |
| CVE-2026-30997 | 7.5 | Apr 13 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input Affected: through 8.0.1 |
| CVE-2025-63757 | 7.5 | Dec 18 | Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0 Affected: 8 |
| CVE-2023-6603 | 7.5 | Dec 31 | Ffmpeg: null pointer dereference in ffmpeg hls parsing Affected: 2.0 through 6.0 |
| CVE-2024-31578 | 7.5 | Apr 17 | FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function Affected: before 7.0 |
| CVE-2024-22861 | 7.5 | Jan 27 | Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module Affected: 6.1 |
| CVE-2020-36138 | 7.5 | Aug 11 | An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS) Affected: 4.3 |
| CVE-2022-3109 | 7.5 | Dec 16 | An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference,… Affected: before 5.0.3 |
| CVE-2021-38291 | 7.5 | Aug 12 | FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c Affected: before 4.1.7; 4.2.0 before 4.2.5; 4.3.0 before 4.3.3; 4.4.0 before 4.4.1 |
| CVE-2020-20451 | 7.5 | May 25 | Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c Affected: 4.2 |
| CVE-2020-20450 | 7.5 | May 25 | FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service Affected: 4.2 |
| CVE-2020-21041 | 7.5 | May 24 | Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service Affected: 4.1 |
| CVE-2020-35965 | 7.5 | Jan 4 | decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations Affected: 4.3.1 before 4.4 |
| CVE-2018-15822 | 7.5 | Aug 23 | The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure Affected: through 2.8 |
| CVE-2012-2805 | 7.5 | Aug 28 | Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service Affected: 0.10 |
| CVE-2017-11665 | 7.5 | Jul 27 | The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash)… Affected: 3.3.2 |
| CVE-2017-9993 | 7.5 | Jun 28 | FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer… Affected: before 2.8.12; 3.0 before 3.1.9; 3.2 before 3.2.6; 3.3 before 3.3.2 |
| CVE-2016-6920 | 7.5 | Jan 23 | Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via… Affected: through 3.1.2 |
| CVE-2015-8662 | 7.3 | Dec 24 | The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet… Affected: through 2.8.3 |
| CVE-2025-9951 | 7.2 | Sep 9 | Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000 Affected: < 8.0 |
| CVE-2023-6605 | 7.2 | Jan 6 | Ffmpeg: dash playlist ssrf vulnerability in ffmpeg Affected: 2.0 through 6.0 |
| CVE-2026-52297 | 7.1 | Sep 13 | FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c Affected: before 9.0 |
| CVE-2026-52296 | 7.1 | Sep 13 | FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c Affected: before 9.0 |
| CVE-2026-75147 | 7.1 | Aug 19 | FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c Affected: before 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8 |
| CVE-2026-64833 | 7.1 | Jul 22 | FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c Affected: 0.7.1 through 8.1.2; 6f80e2765492700622596af720534cef33dd31b4 |
| CVE-2025-59731 | 6.9 | Oct 6 | Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress Affected: 9a32b863074ed4140141e0d3613905c6f1fe61c5 before 8.0; 7.1.1 before 8.0 |
| CVE-2023-51797 | 6.7 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2024-32228 | 6.6 | Jul 1 | FFmpeg 7.0 is vulnerable to Buffer Overflow Affected: 7.0 |
| CVE-2026-107696 | 6.5 | Oct 8 | FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c Affected: through 9.0.2 |
| CVE-2026-107695 | 6.5 | Oct 8 | FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist Affected: before 8.1.3 |
| CVE-2026-66038 | 6.5 | Jul 24 | FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c Affected: through 8.1.2 |
| CVE-2025-25469 | 6.5 | Feb 18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c Affected: before 2025-01-13 |
| CVE-2025-25468 | 6.5 | Feb 18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c Affected: before 2025-01-13 |
| CVE-2025-22921 | 6.5 | Feb 18 | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2024-36616 | 6.5 | Nov 29 | An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file Affected: 6.1.1 |
| CVE-2020-20902 | 6.5 | Sep 20 | A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized… Affected: 4.2.1 |
| CVE-2020-21697 | 6.5 | Aug 10 | A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file Affected: 4.2 |
| CVE-2020-22056 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c Affected: 4.2 |
| CVE-2020-22054 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c Affected: 4.2 |
| CVE-2020-22051 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c Affected: 4.2 |
| CVE-2020-22049 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c Affected: 4.2 |
| CVE-2020-22048 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c Affected: 4.2 |
| CVE-2020-22046 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c Affected: 4.2 |
| CVE-2020-22044 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c Affected: 4.2 |
| CVE-2020-22043 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c Affected: 4.2 |
| CVE-2020-22042 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c Affected: 4.2 |
| CVE-2020-22041 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc Affected: 4.2 |
| CVE-2020-22040 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c Affected: 4.2 |
| CVE-2020-22039 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function Affected: 4.2 |
| CVE-2020-22038 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c Affected: 4.2 |
The 500 most important CVEs for this product (exploited first, then by severity)
