PT-2026-140980

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decode frame ignores init get bits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing rea...

PT-2026-141044

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits per raw sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode gbrp...

PT-2026-140981

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble decode frame in libavcodec/vble.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer tha...

CVE-2026-125216: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

PT-2026-140986

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp decode frame in libavcodec/mpegaudiodec template.c because init get bits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causin...

CVE-2026-125174: FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count()…

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ffhapsetchunkcount in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes...

CVE-2026-125068: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame()…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-125231: FFmpeg: FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because…

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125069: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125071: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe...

PT-2026-140983

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp decode frame ignores init get bits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash...

PT-2026-140985

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode fram...

PT-2026-141059

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx decode header updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sampl...

PT-2026-140982

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode frame in libavcodec/bink.c ignores init get bits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process f...

CVE-2026-125225: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-125070: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c,…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

PT-2026-141043

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff dovi rpu generate in libavcodec/dovi rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi...

cve-2021-3449

CVE-2021-3449 OpenSSL This issue was reported to OpenSSL on 17th March 2021 by Nokia. The fix was developed by Peter Kästle and Samuel Sapalski from Nokia. Mitigation The only known fix is to update libssl1.1. Even though some applications use hardened TLS configurations by default that disable T...

PHP_8.1.x_Exploit

🚀 PHP CVE Autopilot Automated detection & exploitation of critical PHP vulnerabilities CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh is a single‑file, zero‑configuration security assessment tool that automatically discovers vulnerable PHP endpoints and...

CVE-2026-100082

A flaw was found in the Linux kernel's Xen block backend xen-blkback driver. A race condition occurs when input/output I/O statistics are read through the sysfs interface while a frontend device is being disconnected. Because reading the statistics is not synchronized with freeing device memory, ...