FF
Product
FFmpeg
532
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 144Medium 146Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-59731 | 6.9 | Oct 6 | Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress Affected: 9a32b863074ed4140141e0d3613905c6f1fe61c5 before 8.0; 7.1.1 before 8.0 |
| CVE-2023-51797 | 6.7 | Apr 19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2024-32228 | 6.6 | Jul 1 | FFmpeg 7.0 is vulnerable to Buffer Overflow Affected: 7.0 |
| CVE-2026-107696 | 6.5 | Oct 8 | FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c Affected: through 9.0.2 |
| CVE-2026-107695 | 6.5 | Oct 8 | FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist Affected: before 8.1.3 |
| CVE-2026-66038 | 6.5 | Jul 24 | FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c Affected: through 8.1.2 |
| CVE-2025-25469 | 6.5 | Feb 18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c Affected: before 2025-01-13 |
| CVE-2025-25468 | 6.5 | Feb 18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c Affected: before 2025-01-13 |
| CVE-2025-22921 | 6.5 | Feb 18 | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.1; 7.1; +7 more |
| CVE-2024-36616 | 6.5 | Nov 29 | An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file Affected: 6.1.1 |
| CVE-2020-20902 | 6.5 | Sep 20 | A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized… Affected: 4.2.1 |
| CVE-2020-21697 | 6.5 | Aug 10 | A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file Affected: 4.2 |
| CVE-2020-22056 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c Affected: 4.2 |
| CVE-2020-22054 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c Affected: 4.2 |
| CVE-2020-22051 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c Affected: 4.2 |
| CVE-2020-22049 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c Affected: 4.2 |
| CVE-2020-22048 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c Affected: 4.2 |
| CVE-2020-22046 | 6.5 | Jun 2 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c Affected: 4.2 |
| CVE-2020-22044 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c Affected: 4.2 |
| CVE-2020-22043 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c Affected: 4.2 |
| CVE-2020-22042 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c Affected: 4.2 |
| CVE-2020-22041 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc Affected: 4.2 |
| CVE-2020-22040 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c Affected: 4.2 |
| CVE-2020-22039 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function Affected: 4.2 |
| CVE-2020-22038 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c Affected: 4.2 |
| CVE-2020-22037 | 6.5 | Jun 1 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c Affected: 4.2 |
| CVE-2020-22033 | 6.5 | May 27 | A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user cause a Denial of… Affected: 4.2 |
| CVE-2020-22028 | 6.5 | May 26 | Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service Affected: 4.2 |
| CVE-2020-22026 | 6.5 | May 26 | Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service Affected: 4.2 |
| CVE-2020-22024 | 6.5 | May 26 | Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious user cause Denial of Service Affected: 4.2 |
| CVE-2020-22021 | 6.5 | May 26 | Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service Affected: 4.2 |
| CVE-2020-22020 | 6.5 | May 26 | Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service Affected: 4.2 |
| CVE-2020-22019 | 6.5 | May 26 | Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service Affected: 4.2 |
| CVE-2020-20453 | 6.5 | May 25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service Affected: 4.2 |
| CVE-2020-20448 | 6.5 | May 25 | FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service Affected: 4.1.3 |
| CVE-2020-20446 | 6.5 | May 25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service Affected: 4.2 |
| CVE-2020-20445 | 6.5 | May 25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service Affected: 4.2 |
| CVE-2020-35964 | 6.5 | Jan 3 | track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing Affected: 4.3.1 |
| CVE-2019-13390 | 6.5 | Jul 7 | In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c Affected: 4.1.3 |
| CVE-2019-9721 | 6.5 | Mar 12 | A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in… Affected: 3.2; 4.1 |
| CVE-2019-9718 | 6.5 | Mar 12 | In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in… Affected: 3.2; 4.1 |
| CVE-2019-1000016 | 6.5 | Feb 4 | FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service Affected: 4.1 |
| CVE-2018-1999015 | 6.5 | Jul 23 | FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading Affected: through 4.0.1 |
| CVE-2018-1999014 | 6.5 | Jul 23 | FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS Affected: through 4.0.1 |
| CVE-2018-1999013 | 6.5 | Jul 23 | FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to… Affected: through 4.0.1 |
| CVE-2018-1999012 | 6.5 | Jul 23 | FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows… Affected: through 4.0.1 |
| CVE-2018-14395 | 6.5 | Jul 19 | libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when… Affected: 3.2; 4.0 |
| CVE-2018-14394 | 6.5 | Jul 19 | libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio… Affected: before 4.0.2 |
| CVE-2018-13304 | 6.5 | Jul 5 | In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while… Affected: 4.0.1 |
| CVE-2018-13303 | 6.5 | Jul 5 | In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer… Affected: 4.0.1 |
The 500 most important CVEs for this product (exploited first, then by severity)
