CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — PoC de escritura fuera de límites en el montón de MagicYUV de FFmpeg !WARNING Este repositorio contiene un PoC funcional de explotación para una vulnerabilidad de corrupción del montón. Está destinado únicamente a investigación de seguridad autorizada, contextos CTF y...

CVE-2026-8461

🎬 CVE-2026-8461 — PixelSmash FFmpeg MagicYUV 解码器中的严重越界写入漏洞 恶意视频文件可以成为武器。 PixelSmash 是一个影响 FFmpeg MagicYUV 解码器的严重内存损坏漏洞，攻击者可利用它触发越界写入 ，导致应用程序崩溃，甚至可能实现远程代码执行 。 📖 概述 CVE-2026-8461 是在 FFmpeg 的libavcodec MagicYUV 解码器中发现的一个高危 漏洞。 该漏洞是由于帧解码过程中边界验证不当造成的，允许特制的媒体文件写入分配内存之外的位置。 自动处理上传或下载视频的应用程序可能无需用户交互即受影响。...

cve-2025-9951-ffmpeg-jp2-poc

CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...

CVE-2024-53615

CVE-2024-53615 Karl Ward 的 files.gallery v0.3.0 至 0.11.0 版本中视频缩略图渲染组件存在命令注入漏洞，允许远程攻击者通过精心构造的视频文件执行任意代码。 前置条件： PATH 中存在 ffmpeg config.php：'allowupload' = true PHP 配置中必须启用 exec 漏洞位于以下行（取自版本 0.9.12），该行用于生成视频预览： $cmd = $ffmpegpath . ' -ss 3 -t 1 -hidebanner -i "' . strreplace'"', '"', $this-path . '"...

FFMPEG-exploit

Este repositorio no tiene un README...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

CVE-2026-8461-PoC

CVE-2026-8461 概念验证 !WARNING 此概念验证完全由AI生成。 用法: python exploitcve20268461.py --baseline --frames 25 -o baseline.avi 未打补丁的ffmpeg版本在处理baseline.avi时会崩溃。...

PixelSmash

CVE-2026-8461 — PixelSmash Una prueba de concepto funcional para CVE-2026-8461, una escritura fuera de límites en el decodificador MagicYUV de FFmpeg. Incluye un entorno de laboratorio que compila un FFmpeg vulnerable desde el código fuente, y un pequeño reproductor Qt utilizado para demostrar el...

CVE-2026-26833

CVE-2026-26833: inyección de comandos del sistema operativo en thumbler Resumen thumbler hasta la versión 1.1.2 permite la inyección de comandos del sistema operativo en thumbnail en lib/thumbler.js. El paquete concatena los valores input, output, time y size en una única cadena de comandos ffmpe...

practice-22-23

Proyecto Para ejecutar: ./script.sh Repositorio en GitHub - https://github.com/LaCinquette/practice-22-23 Desarrollo 1. Para buscar la vulnerabilidad elegí el proyecto FFmpeg. Encontré en él un commit que cumplía los requisitos, a saber: Correspondía al tipo CWE-476 - desreferencia de puntero nul...

Fedora 45 : OpenBoard / Pencil2D / alsa-plugins / amarok / aqualung / atomes / etc (2026-040732b5dc)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-040732b5dc advisory. Latest FFmpeg stable release and rebuilds of dependent packages. Fixes a number of high severity security bugs: CVE-2026-64832 CVE-2026-70628...

Linux Distros Unpatched Vulnerability : CVE-2026-96611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into...

DEBIAN-CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the movreadispe and readimagegrid paths in libavformat/mov.c. An attacker can trigger the flaw by supplying a crafted HEIF file with oversized ispe width and height values, causing them to be stored as...

CVE-2026-96611

A flaw was found in FFmpeg. A local attacker can craft a malicious High Efficiency Image File Format HEIF file that, when processed, can cause a signed integer overflow. This overflow allows width and height values to become negative, bypassing internal validity checks. This can lead to data...

EUVD-2026-85311

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg versions before 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. When processing a crafted HEIF file, the mov_read_ispe() function stores uint32_t width and height values into signed integer fields without bounds checking, causing values exceeding INT_MAX to become neg...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...