1051 matches found
CVE-2026-70629
A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...
FFmpeg 3.0 < 9.0 Multiple Vulnerabilities
The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out-of-bounds memory read via a crafted video file. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Using “after free” in Codecs in Google Chrome before version 147.0.7727.101 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted video file. Chromium security severity: High...
CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
Use of Uninitialized Resource
Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the rsccdecodeframe path in libavcodec/rscc.c. An attacker can disclose heap memory contents by supplying a crafted RSCC video file whose compressed tile decompresses to fewer bytes than the tile geomet...
Linux Distros Unpatched Vulnerability : CVE-2026-70632
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allow...
UBUNTU-CVE-2026-70632
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...
UBUNTU-CVE-2026-70628
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...
CVE-2026-70632
FFmpeg <= 4.4–
SUSE CVE-2026-17848
Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Medium...
DEBIAN-CVE-2026-17848
Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Medium...
CVE-2026-17848
CVE-2026-17848 concerns the Google Chrome/Chromium codecs component where an integer overflow in Codecs could allow a remote attacker to perform a sandbox escape via a crafted video file. Affected: Chrome/Chromium environments using Codecs prior to 151.0.7922.72. The vulnerability arises from ins...
PT-2026-66167
Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Medium...
EUVD-2026-49548
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app...
CVE-2026-65703
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...
CVE-2026-65703 FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...
EUVD-2026-48370
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...