Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 680

Export CSV
CVE-2026-125186

FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125065

FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125071

FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125174

FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125232

FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125237

FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125242

FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstream_buffers table continuously and causing denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125246

FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125187

FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125189

FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125191

FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125194

FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125207

FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125223

FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125263

FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get_buffer2() allocations and exhaust memory.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125224

FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125225

FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init_get_bits() fails unchecked and get_bits() crashes during MP4, Matroska, FLV or LATM remuxing.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125226

FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125230

FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm_rechunk Filter

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125231

FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg