JLSEC-2025-127 FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in...

FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avfshowspectrum.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

JLSEC-2025-124 An issue was discovered in `decode_frame` in `libavcodec/tiff.c` in FFmpeg version 4.3, allows...

An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...

JLSEC-2025-147 A flaw was found in FFmpeg's DASH playlist support

A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs...

JLSEC-2025-131 FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the `ff_gaussian_blur_8`...

FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ffgaussianblur8 function in libavfilter/edgetemplate.c:116:5 component...

JLSEC-2025-111 `decode_frame` in `libavcodec/exr.c` in FFmpeg 4.3.1 has an out-of-bounds write because of errors in...

decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations...

JLSEC-2025-134 A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fillaudiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in versio...

JLSEC-2025-136 In FFmpeg version n6.1.1, specifically within the `avcodec/speexdec.c` module, a potential security...

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in...

JLSEC-2025-128 FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the...

FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the avsamplessetsilence function in thelibavutil/samplefmt.c:260:9 component...

JLSEC-2025-101 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in...

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...

JLSEC-2025-125 FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the `av_hwframe_ctx_init`...

FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the avhwframectxinit function...

JLSEC-2025-140 FFmpeg n6.1.1 is Integer Overflow

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parseoptions function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds...

JLSEC-2025-107 FFmpeg before 4.2 has a heap-based buffer overflow in `vqa_decode_chunk` because of an out-of-array...

FFmpeg before 4.2 has a heap-based buffer overflow in vqadecodechunk because of an out-of-array access in vqadecodeinit in libavcodec/vqavideo.c...

JLSEC-2025-109 FFmpeg through 4.3 has a heap-based buffer overflow in `avio_get_str` in `libavformat/aviobuf.c`...

FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

JLSEC-2025-149 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants...

Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/afpan.C . This issue affects FFmpeg: 7.1. Issue was fixed: ...

JLSEC-2025-151 A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ffaacsearchfortns of the file libavcodec/aacenctns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The...

JLSEC-2025-113 Buffer Overflow vulnerability exists in FFmpeg 4.1 via `apng_do_inverse_blend` in...

Buffer Overflow vulnerability exists in FFmpeg 4.1 via apngdoinverseblend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service...

JLSEC-2025-120 A vulnerability classified as problematic has been found in ffmpeg

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument ysize leads to out-of-bounds read. It is possible to initiate the attack remotely. The...

PT-2025-45932

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds...

PT-2025-45938

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions...

PT-2025-45905

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim as lon...