FFmpeg 安全漏洞

FFmpeg is a complete set of solutions developed by the FFmpeg team for recording, converting, and streaming audio and video. Version 8.0.1 of FFmpeg contains a security vulnerability, which stems from improper resource release and closure of the tools/zmqsend.c component, potentially leading to...

FFmpeg 安全漏洞

FFmpeg is an open source software library for processing multimedia data. An out-of-bounds read vulnerability exists in FFmpeg. The vulnerability stems from a failure of the readglobalparam function to properly handle specially crafted input, which can be exploited by an attacker to cause a denia...

CVE-2026-30997

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30999

A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the readglobalparam function. An attacker can cause the application to crash or become unavailable by supplying specially crafted input that triggers an out-of-bounds read. Remediation Upgrade ffmpeg to version...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the avbprintfinalize function. An attacker can cause a crash or make the application unavailable by sending specially crafted input that triggers a heap buffer overflow. Remediation A fix was pushed into th...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through improper resource deallocation in the zmqsend.c process. An attacker can cause the application to become unresponsive or crash by providing specially crafted input. Remediatio...

CVE-2026-30997

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-35450

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php,...

CVE-2026-35450

CVE-2026-35450 affects WWBN AVideo (versions 26.0 and earlier). The plugin/API/check.ffmpeg.json.php endpoint exposes FFmpeg remote server configuration and connectivity status without authentication, while sibling endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require admin a...

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

Summary The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php require User::isAdmin. Details The entire...

GHSA-2VG4-RRX4-QCPQ AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

Summary The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php require User::isAdmin. Details The entire...

PT-2026-30335

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The plugin/API/check.ffmpeg.json.php endpoint allows probing the FFmpeg remote server configuration and retrieving connectivity status without authentication. The sibling endpoints kill.ffmpeg.json.ph...

[SECURITY] Fedora 42 Update: gstreamer1-plugin-libav-1.26.11-1.fc42

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...