Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 680

Export CSV
CVE-2026-125234

FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack_encode_init

FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate with many channels, to hang applications transcoding to WavPack.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125238

FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125240

FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper

FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decoder threads and buffers, exhausting memory.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125245

FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125252

FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125254

FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125258

FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125216

FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125221

FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125220

FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125215

FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125072

FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125066

FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125270

FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125269

FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125266

FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125265

FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125257

FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125253

FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read

FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125249

FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg