PatchSiren

FFmpeg CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH FFmpeg CVE published 2026-07-24

CVE-2026-66040

CVE-2026-66040 is a high-severity vulnerability in FFmpeg's native PNG and APNG encoders. It allows remote attackers to corrupt heap memory via a crafted PNG eXIf chunk, potentially leading to process crashes and arbitrary code execution. This vulnerability is particularly concerning due to its potential for heap corruption and code execution, emphasizing the need for immediate patching. Users and organiz [truncated]

HIGH FFmpeg CVE published 2026-07-24

CVE-2026-66039

CVE-2026-66039 is a high-severity vulnerability in FFmpeg's MACE6 audio decoder. It allows attackers to corrupt heap memory by supplying a crafted CAF file, potentially enabling code execution. The vulnerability exists due to a signed integer overflow in the mace_decode_frame() function during output sample count computation. This results in an undersized buffer allocation and a subsequent heap out-of-bou [truncated]

HIGH FFmpeg CVE published 2026-07-24

CVE-2026-66038

CVE-2026-66038 is an information disclosure vulnerability in the LCL/ZLIB video decoder of FFmpeg, a popular open-source multimedia processing tool. The vulnerability allows attackers to expose uninitialized heap memory by providing a specially crafted zlib stream that decompresses to fewer bytes than expected. This can lead to the exposure of sensitive information, including uninitialized heap contents a [truncated]

HIGH FFmpeg CVE published 2026-07-24

CVE-2026-66037

CVE-2026-66037 is an uncontrolled resource consumption vulnerability in the IAMF demuxer of FFmpeg. The vulnerability allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled [truncated]

HIGH FFmpeg CVE published 2026-07-24

CVE-2026-66036

A heap out-of-bounds write vulnerability exists in FFmpeg's vf_hqdn3d filter. This vulnerability allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. The vulnerability was fixed in commit 5d7112c. The affected product is FFmpeg, and the vulnerability class is a hea [truncated]

HIGH FFmpeg CVE published 2026-07-23

CVE-2026-65706

CVE-2026-65706 is an out-of-bounds write vulnerability in the vf_swaprect video filter of FFmpeg versions 3.0 through 8.1.2. The vulnerability allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. This occurs because the filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte [truncated]

HIGH FFmpeg CVE published 2026-07-23

CVE-2026-65705

CVE-2026-65705 is an out-of-bounds write vulnerability in the vf_floodfill video filter of FFmpeg versions 3.4 through 8.1.2. The vulnerability allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent large [truncated]

HIGH FFmpeg CVE published 2026-07-23

CVE-2026-65704

CVE-2026-65704 is an out-of-bounds write vulnerability in FFmpeg through 8.1.2. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(). This triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer. The vulnerability can be exploited by suppl [truncated]

HIGH FFmpeg CVE published 2026-07-23

CVE-2026-65703

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T20:17:21.803Z and has not been modified since then. This out-of-bounds write vulnerability in the TDSC video decoder of FFmpeg versions 2.7 through 8.1.2 allows remote attackers to cause heap corruption by supplying a crafted AVI file. The vulnerability has a high impact due to its potential for [truncated]

HIGH FFmpeg CVE published 2026-07-22

CVE-2026-64834

CVE-2026-64834 is an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c in FFmpeg versions 0.6.3 through 8.1.2. The vulnerability allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunks [truncated]

HIGH FFmpeg CVE published 2026-07-22

CVE-2026-64833

CVE-2026-64833 is an out-of-bounds read vulnerability in the S/PDIF muxer of FFmpeg versions 0.7.1 through 8.1.2. The vulnerability allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. This can be exploited during S/PDIF re-muxing to trigger unauthorized memory reads. The vulnerability has a high severity [truncated]

HIGH FFmpeg CVE published 2026-07-22

CVE-2026-64832

A high-severity double-free vulnerability was discovered in FFmpeg versions 4.4 through 8.1.2, affecting the NVIDIA NVDEC hardware decoder. This vulnerability, tracked as CVE-2026-64832, allows attackers to trigger memory corruption by supplying a crafted video file. The vulnerability is caused by the ff_nvdec_start_frame_sep_ref error path freeing memory via nvdec_fdd_priv_free, while the calling layer s [truncated]

HIGH FFmpeg CVE published 2026-07-22

CVE-2026-64830

CVE-2026-64830 is a heap buffer overflow vulnerability in FFmpeg versions 2.1 through 8.1.2. The vulnerability exists in the VobSub subtitle demuxer and allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream [truncated]

HIGH FFmpeg CVE published 2026-06-18

CVE-2026-8461

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-18T14:17:36.660Z and has not been modified since then. This out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. The issue affects FFmpeg before version 8.1.2, [truncated]

CRITICAL Ffmpeg CVE published 2017-02-09

CVE-2016-10192

CVE-2016-10192 is a critical FFmpeg vulnerability in ffserver.c where failure to validate chunk size can trigger a heap-based buffer overflow. The NVD record rates it 9.8/CRITICAL with network attack vector, low complexity, no privileges required, and no user interaction, making it a plausible remote code execution issue for exposed deployments.

CRITICAL Ffmpeg CVE published 2017-02-09

CVE-2016-10191

CVE-2016-10191 is a critical memory-safety flaw in FFmpeg’s RTMP packet handling. The issue is a heap-based buffer overflow in libavformat/rtmppkt.c caused by failure to check RTMP packet size mismatches. In vulnerable FFmpeg releases, a remote attacker could trigger the flaw through specially crafted input and potentially execute arbitrary code. NVD lists affected branches as FFmpeg before 2.8.10, 3.0.x [truncated]

CRITICAL Ffmpeg CVE published 2017-02-09

CVE-2016-10190

CVE-2016-10190 is a critical memory corruption issue in FFmpeg's HTTP handling code. According to NVD, a remote web server can trigger a heap-based buffer overflow in libavformat/http.c by sending a negative chunk size in an HTTP response. The issue was publicly disclosed on 2017-02-09, with vendor and mailing-list references indicating patch and advisory activity around that time.

HIGH Ffmpeg CVE published 2017-01-23

CVE-2016-6920

CVE-2016-6920 is a heap-based buffer overflow in FFmpeg’s EXR decoder path. The issue affects FFmpeg versions before 3.1.3 and can be triggered remotely through inputs involving tile positions, leading to an application crash and denial of service. NVD assigns a HIGH severity score (CVSS 3.0: 7.5) and classifies the weakness as CWE-119.

CRITICAL Ffmpeg CVE published 2017-01-23

CVE-2016-6164

CVE-2016-6164 is a critical FFmpeg issue in the MOV demuxing path. The flaw is an integer overflow in mov_build_index within libavformat/mov.c, reachable while processing sample size-related data in media files. NVD rates the issue as network-exploitable with no privileges or user interaction required, and assigns high confidentiality, integrity, and availability impact. Affected versions are identified a [truncated]