PT-2026-140978

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726 decode frame in libavcodec/g726.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL...

PT-2026-141048

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic decode frame in libavcodec/mimic.c that fails to report frame progress when init get bits8 fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding...

PT-2026-141051

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9 decode frame skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak...

PT-2026-140981

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble decode frame in libavcodec/vble.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer tha...

PT-2026-140997

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape decode frame in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale...

PT-2026-141042

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm bluray decode frame in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray M2TS LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past t...

PT-2026-141009

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic decode frame 15 16BPP in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI BRUN chunk whose non-terminating byte-sw...

PT-2026-140993

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode frame in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized...

PT-2026-140995

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak decode frame in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecod...

PT-2026-141027

FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1 decode frame in libavcodec/vc1dec.c that leaks slice buffers when init get bits8 fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications...

PT-2026-134685

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx decode frame to copy uninitialized av malloc buffer...

Astra Linux – Vulnerability in ffmpeg

The decodeframe function in libavcodec/exr.c in FFmpeg 4.3.1 has a buffer overflow due to errors in calculating when to perform memset zero operations...

JLSEC-2026-1177 FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX...

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in adxdecodeframe in libavcodec/adxdec.c. An attacker can trigger memory corruption or a crash by supplying a crafted ADX or AAX audio stream that delivers AVPKTDATANEWEXTRADATA mid-stream and changes the channel...

OSV-2026-886 Heap-buffer-overflow in ihevcd_fmt_conv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520748344 Crash type: Heap-buffer-overflow WRITE 8 Crash state: ihevcdfmtconv ihevcddecode Codec::decodeFrame...

PT-2026-50615

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520748344 Crash type: Heap-buffer-overflow WRITE 8 Crash state: ihevcd fmt conv ihevcd decode Codec::decodeFrame...

OSV-2025-900 Heap-buffer-overflow in DecodeFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=460575093 Crash type: Heap-buffer-overflow READ Crash state: DecodeFrame testdecoderprocess EsOutSend...

JLSEC-2025-121 An issue was discovered in the FFmpeg package, where `vp3_decode_frame` in `libavcodec/vp3.c` lacks...

An issue was discovered in the FFmpeg package, where vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc and will cause a null pointer dereference, impacting availability...

JLSEC-2025-111 `decode_frame` in `libavcodec/exr.c` in FFmpeg 4.3.1 has an out-of-bounds write because of errors in...

decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations...

JLSEC-2025-133 A vulnerability was found in FFmpeg up to 7.0.1

A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...