CVE-2019-2107

CVE-2019-2107 CVE-2019-2107 CVE-2019-2107 - looks scary. Still remember Stagefright and PNG bugs vulns .... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video with tiles enabled - pspps-i1tilesenabledflag you can possibly do RCE. The codec affected i...

CVE-2019-2107

CVE-2019-2107 CVE-2019-2107 CVE-2019-2107 - looks scary. Still remember Stagefright and PNG bugs vulns .... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video with tiles enabled - pspps-i1tilesenabledflag you can possibly do RCE. The codec affected i...

CVE-2026-125262

A flaw was found in FFmpeg. A heap buffer overflow can occur in the LCEVC decoder when decoding a specially crafted H.264 or HEVC video file due to a missing validation of output picture dimensions against the allocated frame. This vulnerability can lead to memory corruption, potentially resultin...

CVE-2026-125229

A flaw was found in FFmpeg. An out-of-bounds write can occur in the HEVC H.265 decoder when decoding a specially crafted HEVC video file due to a missing validation of minimum frame dimensions for the median predictor. This vulnerability can lead to memory corruption, potentially resulting in an...

CVE-2026-64747

CVE-2026-64747 — AppleAVE2 kernel driver: wire format + reachability PoC Root-cause analysis and macOS reachability proof-of-concept for CVE-2026-64747, a buffer overflow in the AppleAVE2 video encoder kernel extension com.apple.driver.AppleAVE2 fixed in macOS 26.6 kext 905.40.1. AppleAVE2 —...

SUSE CVE-2026-125262

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to...

Linux Distros Unpatched Vulnerability : CVE-2026-125258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a division by zero vulnerability in doviconfigureext in libavcodec/dovirpuenc.c that allows attackers to crash the process via an...

Linux Distros Unpatched Vulnerability : CVE-2026-125185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values...

Linux Distros Unpatched Vulnerability : CVE-2026-125262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against th...

Linux Distros Unpatched Vulnerability : CVE-2026-125183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a denial of service vulnerability in pps3dextension in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded...

Linux Distros Unpatched Vulnerability : CVE-2026-125263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame...

PT-2026-144557

In tone mapping info of hevc decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation...

PT-2026-144572

In s inter rps pred of hevc decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation...

UBUNTU-CVE-2026-125262

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to...

UBUNTU-CVE-2026-125183

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps3dextension in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit...

PT-2026-144580

In knee function info of hevc decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation...

UBUNTU-CVE-2026-125185

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

CVE-2026-125262

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to...

PT-2026-144577

In sub layer hrd parameters of hevc decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation...

UBUNTU-CVE-2026-125263

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...