FF
Product
FFmpeg
533
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 145Medium 146Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2213 | 6.5 | Feb 3 | The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via… Affected: through 2.8.5 |
| CVE-2026-90815 | 6.3 | Sep 14 | FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5; +21 more |
| CVE-2024-36613 | 6.2 | Jan 3 | FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or… Affected: 6.1.1 |
| CVE-2024-36618 | 6.2 | Nov 29 | FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition Affected: 6.1.1 |
| CVE-2024-36617 | 6.2 | Nov 29 | FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder Affected: before 3.4.14; 4.0 before 4.2.9; 4.3 before 4.3.7; 4.4 before 4.4.5; 5.0 before 6.1.2 |
| CVE-2026-107675 | 5.9 | Oct 8 | FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol Affected: through 9.0.2 |
| CVE-2024-36615 | 5.9 | Nov 29 | FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder Affected: 7.0 |
| CVE-2026-75145 | 5.8 | Aug 19 | FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer Affected: before b4c199c5906ff53368926c2a5839881f41957e7f |
| CVE-2025-59730 | 5.7 | Oct 6 | Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48 Affected: 829680f96a7a7ff02d1543895ec0fb713309d5c0 before 8.0 |
| CVE-2025-59729 | 5.7 | Oct 6 | Heap-buffer-overflow read in FFmpeg DHAV get_duration Affected: a218cafe4d3be005ab0c61130f90db4d21afb5db before 8.0 |
| CVE-2026-70631 | 5.5 | Aug 6 | FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder Affected: 0.5 before 9.0 |
| CVE-2026-70630 | 5.5 | Aug 6 | FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder Affected: 3.0 before 9.0 |
| CVE-2026-70629 | 5.5 | Aug 6 | FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder Affected: 3.0 before 9.0 |
| CVE-2026-66037 | 5.5 | Jul 24 | FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() Affected: through 8.1.2 |
| CVE-2025-12343 | 5.5 | Feb 18 | Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend Affected: 6.1 before 8.1 |
| CVE-2025-10256 | 5.5 | Feb 18 | Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c) Affected: 3.2 before 8.0 |
| CVE-2025-1373 | 5.5 | Feb 17 | A vulnerability was found in FFmpeg up to 7.1 Affected: through 7.1 |
| CVE-2024-35369 | 5.5 | Nov 29 | In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when… Affected: 6.1.1 |
| CVE-2023-46407 | 5.5 | Oct 27 | FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function Affected: 6.1 |
| CVE-2021-28429 | 5.5 | Aug 11 | Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted… Affected: 4.3.2 |
| CVE-2014-125025 | 5.5 | Jun 19 | A vulnerability classified as problematic has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125023 | 5.5 | Jun 19 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125022 | 5.5 | Jun 19 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125021 | 5.5 | Jun 19 | A vulnerability was found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125019 | 5.5 | Jun 19 | A vulnerability, which was classified as problematic, was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125018 | 5.5 | Jun 19 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125016 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125014 | 5.5 | Jun 18 | A vulnerability classified as problematic was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125013 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125012 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125010 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125009 | 5.5 | Jun 18 | A vulnerability classified as problematic has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125008 | 5.5 | Jun 18 | A vulnerability classified as problematic has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125007 | 5.5 | Jun 18 | A vulnerability classified as problematic was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125006 | 5.5 | Jun 18 | A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125005 | 5.5 | Jun 18 | A vulnerability, which was classified as problematic, was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2014-125004 | 5.5 | Jun 18 | A vulnerability has been found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125003 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 and classified as problematic Affected: 2.0 |
| CVE-2014-125002 | 5.5 | Jun 18 | A vulnerability was found in FFmpeg 2.0 Affected: 2.0 |
| CVE-2022-1475 | 5.5 | May 2 | An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file Affected: 4.2 before 4.4.2; 5.0 |
| CVE-2020-23906 | 5.5 | Nov 10 | FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity Affected: 4.2 |
| CVE-2021-3566 | 5.5 | Aug 5 | Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it Affected: before 4.3 |
| CVE-2021-38114 | 5.5 | Aug 4 | libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868 Affected: 4.4 |
| CVE-2020-13904 | 5.5 | Jun 7 | FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is… Affected: 2.8; 4.2.3 |
| CVE-2015-1208 | 5.5 | Jan 9 | Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack… Affected: before 2.4.6 |
| CVE-2016-9561 | 5.5 | Dec 23 | The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed… Affected: through 3.2 |
| CVE-2016-8595 | 5.5 | Dec 23 | The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file Affected: through 3.1.4 |
| CVE-2016-7905 | 5.5 | Dec 23 | The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file Affected: through 3.1.3 |
| CVE-2016-7785 | 5.5 | Dec 23 | The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file Affected: through 3.1.3 |
| CVE-2016-7562 | 5.5 | Dec 23 | The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file Affected: through 3.1.3 |
The 500 most important CVEs for this product (exploited first, then by severity)