CVE-2026-75143: Heap-based Buffer Overflow

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75145: Incorrect Conversion between Numeric Types

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

PT-2026-78525

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 9d786e4 Description A stack buffer overflow exists in the MPEG-PS muxer within the libavformat/mpegenc.c file. This occurs when the software processes input containing more streams than the muxer's fixed-size...

PT-2026-78526

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1c10bcc Description A heap buffer overflow exists in the RIST protocol reader within libavformat/librist.c. The function librist read fails to respect its size argument, copying the entire received payload lengt...

CVE-2026-75146: Out-of-bounds Read

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-091345)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091345 advisory. trackheader in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. Tenable has extracted the preceding descripti...

OESA-2026-3211 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: Integer overflow...

OESA-2026-3207 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: Integer overflow...

CVE-2026-64830: Heap-based Buffer Overflow

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

JLSEC-2026-652 FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

CVE-2026-40962

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

CVE-2026-40962: Integer Overflow or Wraparound

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

JLSEC-2025-137 FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an...

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service DoS condition...

JLSEC-2025-145 FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an...

FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service DoS condition or other undefined behavior...

JLSEC-2025-122 A null pointer dereference issue was discovered in 'FFmpeg' in `decode_main_header()` function of...

A null pointer dereference issue was discovered in 'FFmpeg' in decodemainheader function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformatnewstream and triggers the null pointer dereference error, causing an application to crash...

EUVD-2019-4884

Malware in sbrugna...

EUVD-2025-4559

Malicious code in bioql PyPI...

EUVD-2025-4576

Malicious code in bioql PyPI...

EUVD-2022-42728

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2016-5115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The avcodecdecodeaudio4 function in libavcodec in libavformat 57.34.103, as used in MPlayer, allows remote attackers to cause a denial of service out-of-bounds...