PT-2026-141087

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff prores kostya encode init that miscalculates frame size upper bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores ks encoder, causing encode frame to...

PT-2026-141089

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode frame in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images...

PT-2026-141028

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265 encode frame never frees the rpu.payload allocated by ff dovi rpu generate. Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265...

PT-2026-141023

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm encode frame in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where abou...

PT-2026-141057

FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode frame function of libavcodec/huffyuvenc.c, because encode init never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall...

PT-2026-141022

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm dvd encode frame in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wr...

PT-2026-141015

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta encode frame in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame,...

PT-2026-141045

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq dpcm encode frame in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized...

OSV-2026-97 Heap-buffer-overflow in vpx_wb_write_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476466137 Crash type: Heap-buffer-overflow WRITE 1 Crash state: vpxwbwriteliteral vp9packbitstream encodeframetodatarate...

SUSE CVE-2016-2327

libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via a crafted .avi file, related to the apngencodeframe and encodeapng...

Libav 'pcm_encode_frame' function heap out-of-bounds read vulnerability

Libav formerly FFmpeg is Libav team's set of cross-platform audio and video can be recorded, converted to a solution, which includes a libavcodec encoder. A security vulnerability exists in the 'pcmencodeframe' function in the libavcodec/pcm.c file in Libav version 12.2. A remote attacker can...

UBUNTU-CVE-2017-18246

The pcmencodeframe function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted media file...

PT-2018-6772

Name of the Vulnerable Software and Affected Versions: Libav version 12.2 Description: The issue allows remote attackers to cause a denial of service, specifically a heap-based buffer over-read, by providing a crafted media file. This is due to a problem in the pcm encode frame function located i...

PT-2016-1272

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.5 Description The issue is caused by a buffer overflow in the apng encode frame and encode apng functions in the libavcodec/pngenc.c file of the FFmpeg multimedia library. This can be exploited by a remote attacker...