CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

PixelSmash

CVE-2026-8461 — PixelSmash A working proof-of-concept for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. Includes a lab harness that builds a vulnerable FFmpeg from source, and a small Qt player used to demonstrate the exploit in a video-player context. For research and...

CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...

CVE-2026-70628 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

GHSA-5F73-3R3J-P8MR vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

CVE-2025-10256 vulnerabilities

Vulnerabilities for packages: ffmpeg-fips...

GHSA-QR3P-83WM-PX3F vulnerabilities

Vulnerabilities for packages: ffmpeg-fips...

CVE-2026-70630 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

CVE-2026-70631 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

GHSA-7MRQ-J773-6867 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

GHSA-Q24X-99V6-6HXC vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

CVE-2025-59732 vulnerabilities

Vulnerabilities for packages: ffmpeg-fips...

CVE-2026-70629 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

CVE-2026-70632 vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

GHSA-QW9H-2HHV-HPFR vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

GHSA-C96Q-RF2R-2XJ8 vulnerabilities

Vulnerabilities for packages: ffmpeg-fips...

GHSA-824F-V6QW-342H vulnerabilities

Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...

CVE-2026-8461-PoC

CVE-2026-8461 PoC !WARNING This PoC is entirely generated by AI. Usage: python exploitcve20268461.py --baseline --frames 25 -o baseline.avi An unpatched version of ffmpeg will crash when processing baseline.avi...

CVE-2026-8461

🎬 CVE-2026-8461 — PixelSmash Critical Out-of-Bounds Write in FFmpeg MagicYUV Decoder A malicious video file can become a weapon. PixelSmash is a critical memory corruption vulnerability affecting FFmpeg's MagicYUV decoder that allows an attacker to trigger an out-of-bounds write , resulting in...