11027 matches found
PixelSmash
CVE-2026-8461 — PixelSmash A working proof-of-concept for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. Includes a lab harness that builds a vulnerable FFmpeg from source, and a small Qt player used to demonstrate the exploit in a video-player context. For research and...
CVE-2026-26833
CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...
CVE-2026-8461
🎬 CVE-2026-8461 — PixelSmash Critical Out-of-Bounds Write in FFmpeg MagicYUV Decoder A malicious video file can become a weapon. PixelSmash is a critical memory corruption vulnerability affecting FFmpeg's MagicYUV decoder that allows an attacker to trigger an out-of-bounds write , resulting in...
cve-2025-9951-ffmpeg-jp2-poc
CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...
practice-22-23
Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...
CVE-2026-8461-PoC
CVE-2026-8461 PoC !WARNING This PoC is entirely generated by AI. Usage: python exploitcve20268461.py --baseline --frames 25 -o baseline.avi An unpatched version of ffmpeg will crash when processing baseline.avi...
FFMPEG-exploit
This repository does not have a README...
CVE-2026-8461-EXP
CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...
CVE-2024-53615
CVE-2024-53615 A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file. Prerequisites: ffmpeg in PATH config.php: 'allowupload' = true exec must be...
CVE-2026-52617
CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...
CVE-2026-70629 vulnerabilities
Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...
CVE-2026-70630 vulnerabilities
Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...
GHSA-7MRQ-J773-6867 vulnerabilities
Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...
GHSA-Q24X-99V6-6HXC vulnerabilities
Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...
CVE-2025-10256 vulnerabilities
Vulnerabilities for packages: ffmpeg-fips...
CVE-2025-59732 vulnerabilities
Vulnerabilities for packages: ffmpeg-fips...
GHSA-QR3P-83WM-PX3F vulnerabilities
Vulnerabilities for packages: ffmpeg-fips...
CVE-2026-70628 vulnerabilities
Vulnerabilities for packages: ffmpeg-cuda-fips, ffmpeg-fips...