7923 matches found
CVE-2026-64830
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...
RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:43711)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:43711 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...
PT-2026-63434
Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.1 through 8.1.2 Description A heap buffer overflow exists in the VobSub subtitle demuxer. An attacker can corrupt adjacent heap memory by providing a malicious .sub/.idx subtitle file that declares more distinct stream IDs th...
SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:3149-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3149-1 advisory. This update for ffmpeg fixes the following issue - CVE-2025-10256: NULL pointer dereference in Firequalizer filter...
Security update for ffmpeg
This update for ffmpeg fixes the following issue CVE-2025-10256: NULL pointer dereference in Firequalizer filter bsc1249431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...
SUSE-SU-2026:3149-1 Security update for ffmpeg
This update for ffmpeg fixes the following issue - CVE-2025-10256: NULL pointer dereference in Firequalizer filter bsc1249431...
OESA-2026-3084 ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...
CVE-2026-55173
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
CVE-2026-55173 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
CVE-2026-55173
Summary: CVE-2026-55173 affects WWBN AVideo (versions 29.0 and below). The issue is an OS command injection in the ffmpeg command construction: sanitizeFFmpegCommand() fails to neutralize a single ‘&’ (background operator). The fix from CVE-2026-33482 added several metacharacters to the denylist ...
CVE-2026-63305
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...
CVE-2026-63305
The CVE-2026-63305 entry concerns AVideo up to version 29.0, where the ffmpeg.json.php endpoint concatenates notifyCode and callback into a shell command without escaping. This allows an attacker who can craft an encrypted payload to inject shell metacharacters and execute OS commands as the web-...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...
MGASA-2026-0249 Updated ffmpeg packages fix a security vulnerability
The updated packages fix a security vulnerability: Heap out-of-bounds write via odd sliceheight in FFmpeg MagicYUV decoder. CVE-2026-8461...
GHSA-QFF7-4Q6C-M8H6 vulnerabilities
Vulnerabilities for packages: ffmpeg...
