CVE-2026-35033

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any...

CVE-2026-35033: Improper Neutralization of Argument Delimiters in a Command

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any...

The vulnerability of the multi-media library Ffmpeg, related to reading data beyond the buffer boundary in memory, allows a hacker to cause a service failure.

The vulnerability of the FFmpeg multimedia library relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

FFmpeg av_bprint_finalize() function heap buffer overflow vulnerability

FFmpeg is an open source software library for processing multimedia data. A heap buffer overflow vulnerability exists in FFmpeg. The vulnerability stems from the avbprintfinalize function failing to properly handle specially crafted input and can be exploited by an attacker to cause a denial of...

PT-2026-32958

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7 Description An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds lowercase...

CVE-2026-30997

A flaw was found in FFmpeg. An attacker can exploit an out-of-bounds read vulnerability within the readglobalparam function by providing a specially crafted input. This can lead to a Denial of Service DoS, making the affected system or application unavailable. Mitigation For systems processing...

CVE-2026-30998

A flaw was found in FFmpeg. An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component allows a remote attacker to cause a Denial of Service DoS. By supplying a specially crafted input file, the attacker can trigger this flaw, leading to the application becoming...

CVE-2026-30999

A flaw was found in FFmpeg. A remote attacker could exploit a heap buffer overflow vulnerability in the avbprintfinalize function by providing a specially crafted input. This could lead to a Denial of Service DoS, making the affected system or application unavailable to legitimate users. Mitigati...

EUVD-2026-21976

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-21974

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...

DEBIAN-CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30998

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...

CVE-2026-30997

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

DEBIAN-CVE-2026-30997

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

UBUNTU-CVE-2026-30998

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...

UBUNTU-CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30997

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30998

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...