# FFmpeg.

Every CVE that names FFmpeg among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure](https://agentprime.io/advisories/CVE-2026-120247.md)
  `CVE-2026-120247` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder](https://agentprime.io/advisories/CVE-2026-120246.md)
  `CVE-2026-120246` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder](https://agentprime.io/advisories/CVE-2026-120245.md)
  `CVE-2026-120245` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder](https://agentprime.io/advisories/CVE-2026-120244.md)
  `CVE-2026-120244` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette](https://agentprime.io/advisories/CVE-2026-120243.md)
  `CVE-2026-120243` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path](https://agentprime.io/advisories/CVE-2026-120210.md)
  `CVE-2026-120210` · CVE record: FFmpeg FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Path traversal
- [FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling](https://agentprime.io/advisories/CVE-2026-107698.md)
  `CVE-2026-107698` · CVE record: FFmpeg FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()](https://agentprime.io/advisories/CVE-2026-107697.md)
  `CVE-2026-107697` · CVE record: FFmpeg FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c](https://agentprime.io/advisories/CVE-2026-107696.md)
  `CVE-2026-107696` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist](https://agentprime.io/advisories/CVE-2026-107695.md)
  `CVE-2026-107695` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes](https://agentprime.io/advisories/CVE-2026-107678.md)
  `CVE-2026-107678` · CVE record: FFmpeg FFmpeg · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media](https://agentprime.io/advisories/CVE-2026-107677.md)
  `CVE-2026-107677` · CVE record: FFmpeg FFmpeg · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer](https://agentprime.io/advisories/CVE-2026-107676.md)
  `CVE-2026-107676` · CVE record: FFmpeg FFmpeg · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol](https://agentprime.io/advisories/CVE-2026-107675.md)
  `CVE-2026-107675` · CVE record: FFmpeg FFmpeg · CVSS 6.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-322
- [FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts](https://agentprime.io/advisories/CVE-2026-107660.md)
  `CVE-2026-107660` · CVE record: FFmpeg FFmpeg · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS
- [Integer overflow in FFmpeg](https://agentprime.io/advisories/CVE-2026-96611.md)
  `CVE-2026-96611` · CVE record: FFmpeg FFmpeg · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [FFmpeg Duration hlsproto.c parse_playlist denial of service](https://agentprime.io/advisories/CVE-2026-90816.md)
  `CVE-2026-90816` · CVE record: FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds](https://agentprime.io/advisories/CVE-2026-90815.md)
  `CVE-2026-90815` · CVE record: FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in FFmpeg](https://agentprime.io/advisories/CVE-2026-52297.md)
  `CVE-2026-52297` · CVE record: FFmpeg FFmpeg · CVSS 2.9 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in FFmpeg](https://agentprime.io/advisories/CVE-2026-52296.md)
  `CVE-2026-52296` · CVE record: FFmpeg FFmpeg · CVSS 2.9 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in FFmpeg](https://agentprime.io/advisories/CVE-2026-52295.md)
  `CVE-2026-52295` · CVE record: FFmpeg FFmpeg · CVSS 2.9 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c](https://agentprime.io/advisories/CVE-2026-75147.md)
  `CVE-2026-75147` · CVE record: FFmpeg FFmpeg · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c](https://agentprime.io/advisories/CVE-2026-75146.md)
  `CVE-2026-75146` · CVE record: FFmpeg FFmpeg · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer](https://agentprime.io/advisories/CVE-2026-75145.md)
  `CVE-2026-75145` · CVE record: FFmpeg FFmpeg · CVSS 5.8 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-681
- [FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer](https://agentprime.io/advisories/CVE-2026-75144.md)
  `CVE-2026-75144` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg Heap Buffer Overflow via RIST Protocol Reader](https://agentprime.io/advisories/CVE-2026-75143.md)
  `CVE-2026-75143` · CVE record: FFmpeg FFmpeg · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c](https://agentprime.io/advisories/CVE-2026-75142.md)
  `CVE-2026-75142` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing](https://agentprime.io/advisories/CVE-2026-75141.md)
  `CVE-2026-75141` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing](https://agentprime.io/advisories/CVE-2026-70632.md)
  `CVE-2026-70632` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Memory corruption
- [FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder](https://agentprime.io/advisories/CVE-2026-70631.md)
  `CVE-2026-70631` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Memory corruption
- [FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder](https://agentprime.io/advisories/CVE-2026-70630.md)
  `CVE-2026-70630` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Memory corruption
- [FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder](https://agentprime.io/advisories/CVE-2026-70629.md)
  `CVE-2026-70629` · CVE record: FFmpeg FFmpeg · CVSS 6.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Memory corruption
- [FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File](https://agentprime.io/advisories/CVE-2026-70628.md)
  `CVE-2026-70628` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Memory corruption
- [FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter](https://agentprime.io/advisories/CVE-2026-66041.md)
  `CVE-2026-66041` · CVE record: FFmpeg FFmpeg · CVSS 7.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder](https://agentprime.io/advisories/CVE-2026-66040.md)
  `CVE-2026-66040` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File](https://agentprime.io/advisories/CVE-2026-66039.md)
  `CVE-2026-66039` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c](https://agentprime.io/advisories/CVE-2026-66038.md)
  `CVE-2026-66038` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()](https://agentprime.io/advisories/CVE-2026-66037.md)
  `CVE-2026-66037` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter](https://agentprime.io/advisories/CVE-2026-66036.md)
  `CVE-2026-66036` · CVE record: FFmpeg FFmpeg · CVSS 7.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing](https://agentprime.io/advisories/CVE-2026-65706.md)
  `CVE-2026-65706` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Memory corruption
- [FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()](https://agentprime.io/advisories/CVE-2026-65705.md)
  `CVE-2026-65705` · CVE record: FFmpeg FFmpeg · CVSS 7.3 High · Not analysed yet · Published 23 Jul 2026 · Tags: Memory corruption
- [FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder](https://agentprime.io/advisories/CVE-2026-65704.md)
  `CVE-2026-65704` · CVE record: FFmpeg FFmpeg · CVSS 7.3 High · Not analysed yet · Published 23 Jul 2026 · Tags: Memory corruption
- [FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder](https://agentprime.io/advisories/CVE-2026-65703.md)
  `CVE-2026-65703` · CVE record: FFmpeg FFmpeg · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Memory corruption
- [FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder](https://agentprime.io/advisories/CVE-2026-64835.md)
  `CVE-2026-64835` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer](https://agentprime.io/advisories/CVE-2026-64834.md)
  `CVE-2026-64834` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c](https://agentprime.io/advisories/CVE-2026-64833.md)
  `CVE-2026-64833` · CVE record: FFmpeg FFmpeg · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c](https://agentprime.io/advisories/CVE-2026-64832.md)
  `CVE-2026-64832` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder](https://agentprime.io/advisories/CVE-2026-64831.md)
  `CVE-2026-64831` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer](https://agentprime.io/advisories/CVE-2026-64830.md)
  `CVE-2026-64830` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()](https://agentprime.io/advisories/CVE-2026-58049.md)
  `CVE-2026-58049` · CVE record: FFmpeg FFmpeg · CVSS 8.8 High · Not analysed yet · Published 28 Jun 2026 · Tags: Memory corruption
- [Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder](https://agentprime.io/advisories/CVE-2026-8461.md)
  `CVE-2026-8461` · CVE record: FFmpeg FFmpeg · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption
- [Integer overflow in FFmpeg](https://agentprime.io/advisories/CVE-2026-40962.md)
  `CVE-2026-40962` · CVE record: FFmpeg FFmpeg · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Memory corruption
- [Heap-buffer-overflow write in FFmpeg SANM process_ftch](https://agentprime.io/advisories/CVE-2025-59734.md)
  `CVE-2025-59734` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress](https://agentprime.io/advisories/CVE-2025-59733.md)
  `CVE-2025-59733` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress](https://agentprime.io/advisories/CVE-2025-59732.md)
  `CVE-2025-59732` · CVE record: FFmpeg FFmpeg · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress](https://agentprime.io/advisories/CVE-2025-59731.md)
  `CVE-2025-59731` · CVE record: FFmpeg FFmpeg · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48](https://agentprime.io/advisories/CVE-2025-59730.md)
  `CVE-2025-59730` · CVE record: FFmpeg FFmpeg · CVSS 5.7 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Heap-buffer-overflow read in FFmpeg DHAV get_duration](https://agentprime.io/advisories/CVE-2025-59729.md)
  `CVE-2025-59729` · CVE record: FFmpeg FFmpeg · CVSS 5.7 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Memory corruption
- [Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000](https://agentprime.io/advisories/CVE-2025-9951.md)
  `CVE-2025-9951` · CVE record: FFmpeg FFmpeg · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2025 · Tags: Memory corruption
- [FFmpeg IAMF File iamf_parse.c audio_element_obu memory leak](https://agentprime.io/advisories/CVE-2025-1816.md)
  `CVE-2025-1816` · CVE record: FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 2 Mar 2025 · Tags: Denial of service

Older: <https://agentprime.io/advisories/technology/ffmpeg.md?cursor=WyIyMDI1LTAzLTAyVDE0OjAwOjA3LjUxNTAwMFoiLCJDVkUtMjAyNS0xODE2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=ffmpeg>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/ffmpeg/>. Everything for agents: <https://agentprime.io/llms.txt>.