FF
Product
FFmpeg
526
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 141Medium 143Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30754 | 8.8 | Sep 8 | A memory corruption vulnerability exists in FFmpeg before 8.1 Affected: before 8.1 |
| CVE-2026-66040 | 8.8 | Jul 24 | FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder Affected: through 8.1.2 |
| CVE-2026-66036 | 8.8 | Jul 24 | FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter Affected: through 8.1.2 |
| CVE-2026-64835 | 8.8 | Jul 22 | FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder Affected: 4.4 through 8.1.2; 1836ef96846937a6cc2443698a693104f5c0b21e |
| CVE-2026-64832 | 8.8 | Jul 22 | FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c Affected: 4.4 through 8.1.2; 4c6217477fc64305055b37d9d1d0d76d30e37f97 |
| CVE-2026-64831 | 8.8 | Jul 22 | FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder Affected: 8.0 through 8.1.2; 92737390dc133daadce47dd7d2ec8ef3d9ebcbed |
| CVE-2026-64830 | 8.8 | Jul 22 | FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer Affected: 2.1 through 8.1.2; dbd495f066a85ba96b17433f4306582aa37c3951 |
| CVE-2026-8461 | 8.8 | Jun 18 | Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder Affected: before 8.1.2 |
| CVE-2025-1594 | 8.8 | Feb 23 | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1 Affected: through 7.1 |
| CVE-2024-35365 | 8.8 | Jan 3 | FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function Affected: 6.1.1 |
| CVE-2024-7272 | 8.8 | Aug 12 | A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5 Affected: before 5.1.6 |
| CVE-2024-7055 | 8.8 | Aug 6 | A vulnerability was found in FFmpeg up to 7.0.1 Affected: before 4.3.8; 4.4 before 4.4.5; 5.0 before 5.1.6; 6.0 before 6.1.2; 7.0 before 7.0.2 |
| CVE-2023-49502 | 8.8 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the… Affected: 6.1 before 7.0 |
| CVE-2021-38094 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts Affected: 4.2.1 |
| CVE-2021-38093 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified… Affected: 4.2.1 |
| CVE-2021-38092 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified… Affected: 4.2.1 |
| CVE-2021-38091 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified… Affected: 4.2.1 |
| CVE-2021-38090 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified… Affected: 4.2.1 |
| CVE-2020-20898 | 8.8 | Sep 20 | Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified… Affected: 4.2.1 |
| CVE-2020-20896 | 8.8 | Sep 20 | An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a… Affected: 4.2.1 |
| CVE-2020-20892 | 8.8 | Sep 20 | An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due… Affected: 4.2.1 |
| CVE-2020-20891 | 8.8 | Sep 20 | Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts Affected: 4.2.1 |
| CVE-2020-21688 | 8.8 | Aug 10 | A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code Affected: 4.2 |
| CVE-2021-33815 | 8.8 | Jun 3 | dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked Affected: 4.4 |
| CVE-2020-22036 | 8.8 | Jun 1 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22035 | 8.8 | Jun 1 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22034 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22032 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22027 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22025 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22023 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22022 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22017 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22016 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences Affected: 4.2 |
| CVE-2020-22031 | 8.8 | May 27 | A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22030 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and other potential… Affected: 4.2 |
| CVE-2020-22029 | 8.8 | May 27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to… Affected: 4.2 |
| CVE-2020-22015 | 8.8 | May 26 | Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive… Affected: 4.2 |
| CVE-2020-24020 | 8.8 | May 26 | Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length checks, which could… Affected: 4.2.3 |
| CVE-2021-30123 | 8.8 | Apr 7 | FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution Affected: 4.4 |
| CVE-2020-14212 | 8.8 | Jun 16 | FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check… Affected: 4.3 before 4.3.1 |
| CVE-2014-4610 | 8.8 | Jan 14 | Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x… Affected: before 0.10.14; 1.1 before 1.1.12; 1.2 before 1.2.7; 2.0 before 2.0.5; 2.1 before 2.1.5; 2.2 before 2.2.4 |
| CVE-2019-15942 | 8.8 | Sep 5 | FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles… Affected: through 4.2 |
| CVE-2019-13312 | 8.8 | Jul 5 | block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read Affected: 4.1.3 |
| CVE-2019-11339 | 8.8 | Apr 19 | The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access)… Affected: 4.0 before 4.0.4; 4.1 before 4.1.2 |
| CVE-2019-11338 | 8.8 | Apr 19 | libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference… Affected: 3.4; 4.1.2 |
| CVE-2018-1999011 | 8.8 | Jul 23 | FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may… Affected: through 4.0.1 |
| CVE-2018-13302 | 8.8 | Jul 5 | In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in… Affected: 4.0.1 |
| CVE-2018-9841 | 8.8 | Apr 7 | The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified… Affected: through 3.4.2 |
| CVE-2012-5360 | 8.8 | Feb 8 | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file Affected: before 0.11 |
The 500 most important CVEs for this product (exploited first, then by severity)
