Ffmpeg vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-107696 FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limHigh 7.1 · Oct 8, 2026
• CVE-2026-107695 FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() High 7.1 · Oct 8, 2026
• CVE-2026-30754 A memory corruption vulnerability exists in FFmpeg before 8.1.High 8.8 · Sep 8, 2026
• CVE-2026-75146 FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c).High 7.2 · Aug 19, 2026
• CVE-2026-75144 FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers tHigh 8.5 · Aug 19, 2026
• CVE-2026-75143 FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c).Critical 9.3 · Aug 19, 2026
• CVE-2026-75142 FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c).High 8.5 · Aug 19, 2026
• CVE-2026-75141 FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer.High 8.5 · Aug 19, 2026
• CVE-2026-70632 FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allHigh 8.5 · Aug 6, 2026
• CVE-2026-70628 FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c High 8.5 · Aug 6, 2026
• CVE-2026-66041 FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt hHigh 7.7 · Jul 24, 2026
• CVE-2026-66040 FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackerHigh 8.7 · Jul 24, 2026
• CVE-2026-66039 FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heapHigh 8.7 · Jul 24, 2026
• CVE-2026-66038 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose unHigh 7.1 · Jul 24, 2026
• CVE-2026-66037 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated atHigh 7.1 · Jul 24, 2026
• CVE-2026-66036 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap mHigh 7.7 · Jul 24, 2026
• CVE-2026-65706 FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by sHigh 8.5 · Jul 23, 2026
• CVE-2026-65705 FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by High 7.3 · Jul 23, 2026
• CVE-2026-65704 FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processedHigh 7.3 · Jul 23, 2026
• CVE-2026-65703 FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption bHigh 8.5 · Jul 23, 2026
• CVE-2026-64835 FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackersHigh 8.7 · Jul 22, 2026
• CVE-2026-64834 FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers tHigh 8.7 · Jul 22, 2026
• CVE-2026-64833 FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundarHigh 7.1 · Jul 22, 2026
• CVE-2026-64832 FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trHigh 8.7 · Jul 22, 2026
• CVE-2026-64831 FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite rHigh 8.7 · Jul 22, 2026