CVE-2026-8461-PoC

CVE-2026-8461 PoC !WARNING This PoC is entirely generated by AI. Usage: python exploitcve20268461.py --baseline --frames 25 -o baseline.avi An unpatched version of ffmpeg will crash when processing baseline.avi...

CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

CVE-2026-30754

A flaw was found in FFmpeg. This memory corruption vulnerability occurs during the Real-time Transport Protocol RTP encoding of H.264/HEVC streams. A remote attacker could exploit this by providing a specially crafted input file, leading to a negative size parameter being passed to a memory copy...

CVE-2024-53615

CVE-2024-53615 A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file. Prerequisites: ffmpeg in PATH config.php: 'allowupload' = true exec must be...

CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...

practice-22-23

Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...

PixelSmash

CVE-2026-8461 — PixelSmash CVE-2026-8461 的可运行概念验证，该漏洞是 FFmpeg 的 MagicYUV 解码器中的越界写入。包含一个从源码构建存在漏洞的 FFmpeg 的实验环境，以及一个用于在视频播放器场景中演示该漏洞的小型 Qt 播放器。 仅供研究和教育用途。请勿用于攻击您不拥有的系统。 快速开始 git clone https://github.com/Shellmates/PixelSmash.git cd PixelSmash sudo setup.sh lab/preparepayloads.sh "YOURCOMMADGOESHER...

GHSA-7QC3-XQXJ-426P vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

CVE-2026-75144 vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

GHSA-MG5R-49W7-J3CV vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

CVE-2026-75143 vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

[SECURITY] Fedora 44 Update: ffmpeg-8.1.3-1.fc44

FFmpeg is a leading multimedia framework, able to decode, encode, transcode, mux, demux, stream, filter and play pretty much anything that humans and machines have created. It supports the most obscure ancient formats up to the cutting edge. No matter if they were designed by some standards...

Fedora 44 : ffmpeg (2026-3e109a0c85)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3e109a0c85 advisory. Latest upstream bugfix release from 8.1 branch. Changes: https://code.ffmpeg.org/FFmpeg/FFmpeg/src/branch/release/8.1/Changelog . Tenable has...

ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the vfhqdn3d filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent...

FFmpeg: FFmpeg: Integer overflow and out-of-bounds write via CENC subsample data

A flaw was found in FFmpeg. This vulnerability, stemming from an integer overflow and a subsequent out-of-bounds write during the processing of Common Encryption CENC subsample data, could allow a local attacker to potentially trigger information disclosure, data corruption, or a denial of servic...

Moderate: Red Hat Security Advisory: RHEL AI 3.0 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.0 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder

A flaw was found in FFmpeg's libavcodec library. This out-of-bounds write vulnerability, specifically within the MagicYUV decoder, could allow a remote attacker to execute arbitrary code on the affected system. In other scenarios, it may lead to a denial-of-service, making the system unavailable...

FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream

A flaw was found in FFmpeg's RASC video decoder. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC Four Character Code, which is then decoded by libavcodec. This vulnerability triggers a bitstream-controlled out-of-bounds heap write and an adjacent...

ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.

A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to...