1058 matches found
SUSE CVE-2026-66041
FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vfquirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose seco...
Linux Distros Unpatched Vulnerability : CVE-2026-66039
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap...
Linux Distros Unpatched Vulnerability : CVE-2026-65703
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption b...
Use of Uninitialized Resource
Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the zlibdecomp function when processing a zlib stream that inflates to fewer bytes than the expected frame size. An attacker can access uninitialized heap memory contents by supplying a crafted zlib...
CVE-2026-66040
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
CVE-2026-66040 FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
CVE-2026-65706
A flaw was found in FFmpeg. This vulnerability, an out-of-bounds write in the vfswaprect video filter, allows an attacker to corrupt heap memory. By providing a specially crafted NV12 video frame with specific dimensions, a local user can trigger a memory corruption, leading to a process crash...
UBUNTU-CVE-2026-65705
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...
CVE-2026-65706
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...
CVE-2026-65704
CVE-2026-65704 affects FFmpeg up to version 8.1.2, where the TY demuxer’s demux_audio() decrements packet size without bounds checking, producing a negative size that, when passed to memcpy in shorten_decode_frame(), wraps to near SIZE_MAX and causes heap corruption from reads beyond the source a...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop through the rtpasffixheader function in libavformat/rtpdecasf.c. An attacker can exhaust CPU and prevent normal service by sending a crafted RTP/ASF stream containing ASF objects with a chunksize smaller than the 24-byte...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in adxdecodeframe in libavcodec/adxdec.c. An attacker can trigger memory corruption or a crash by supplying a crafted ADX or AAX audio stream that delivers AVPKTDATANEWEXTRADATA mid-stream and changes the channel...
CVE-2026-64833
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...
CVE-2026-64833
FFmpeg versions 0.7.1–8.1.2 expose an out-of-bounds read in the S/PDIF muxer. The root cause is a missing bounds check in spdif_header_dts4, allowing a crafted DTS stream with core_size larger than the packet length to read memory beyond the packet buffer during S/PDIF re-muxing. As described, th...
CVE-2026-64831
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...
CVE-2026-13858
Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Chromium security severity: Medium...
CVE-2026-13858
Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Chromium security severity: Medium...
CVE-2026-13858
CVE-2026-13858 involves an out-of-bounds read in FFmpeg when used by Google Chrome prior to version 150.0.7871.47. The vulnerability could allow a remote attacker to read process memory via a crafted video file, with the impact described as high confidentiality risk and no changes to integrity/av...
PT-2026-54135
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An out of bounds read occurs in FFmpeg, which is a multimedia framework used to handle audio, video, and other multimedia files. This issue allows a remote attacker to obtain potentiall...