8236 matches found
DEBIAN-CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
DEBIAN-CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52617
CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...
CVE-2026-52297
FFmpeg before 9.0 is affected by an out-of-bounds read in the MOV parsing path, specifically in mov_read_iacb within libavformat/mov.c . The root cause is insufficiently padded extradata , which allows the parser to read beyond the intended buffer boundary when processing crafted MOV files. The v...
PT-2026-90977
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
CVE-2026-52296
FFmpeg versions before 9.0 are affected by an out-of-bounds read caused by missing required padding in the WMA extradata allocation paths within libavcodec/wmaenc.c . The vulnerability is rated LOW (CVSS 3.1 score 2.9) with a local attack vector and high complexity, resulting in a limited availab...
PT-2026-90980
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov read iacb in libavformat/mov.c...
CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52297
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in movreadiacb in libavformat/mov.c...
CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
CVE-2026-52296
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c...
CVE-2026-26833
CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...
CVE-2026-73694 FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...
