FFmpeg versions through 8.1.2 contain a heap out-of-bounds write vulnerability in the vf_hqdn3d filter. This occurs when processing crafted video inputs with increasing frame resolution between frames while filtergraph reinitialization is disabled. The flaw leads to heap memory corruption due to undersized buffer allocation during denoising operations. A fix is available and has been released by Ubuntu in updated package versions.
FFmpeg versions up to 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This vulnerability allows remote attackers to corrupt heap memory by crafting a malicious PNG image with a specially crafted eXIf chunk. The flaw can cause heap corruption, process crashes, and potentially arbitrary code execution. The issue is fixed in commit b506faf.
FFmpeg versions through 8.1.2 contain a signed integer overflow vulnerability in the MACE6 audio decoder. This flaw allows attackers to craft malicious CAF audio files that trigger an integer overflow during output sample count computation, leading to undersized buffer allocation and a heap out-of-bounds write. This can potentially enable arbitrary code execution. The vulnerability is fixed in commit aafb5c6 and addressed in updated Ubuntu packages.
FFmpeg versions through 8.1.2 contain an information disclosure vulnerability in the LCL/ZLIB video decoder. This flaw allows attackers to expose uninitialized heap memory by providing a valid zlib stream that decompresses to fewer bytes than the expected frame size. The vulnerability arises because the decompression function treats short decompression as non-fatal and copies a full frame's worth of data from the allocation buffer, potentially leaking sensitive memory contents. This can aid attackers in bypassing address space layout randomization (ASLR) in long-running media processing services. A fix is available in commit 8670835.
FFmpeg versions 7.0 through 8.1.2 contain a heap out-of-bounds write vulnerability in the vf_quirc filter. This vulnerability occurs when processing crafted PGS/SUP subtitle files with mismatched frame dimensions, potentially leading to heap corruption, process crashes, or code execution. The issue is fixed in version 8.1.3 and later.
FFmpeg versions up to 8.1.2 contain an uncontrolled resource consumption vulnerability in the IAMF demuxer. An unauthenticated attacker can trigger excessive memory allocation by crafting the count_label field, causing multi-gigabyte allocations from small input files. This occurs because the mix_presentation_obu() function allocates memory based on attacker-controlled input before validating data, potentially exhausting system memory or causing out-of-memory termination during format probing. The vulnerability is fixed in a commit after version 8.1.2.
FFmpeg through version 8.1.2 contains an out-of-bounds write vulnerability in the TY demuxer's demux_audio() function. This vulnerability is triggered when processing a crafted ffconcat file with the -safe 0 flag, causing heap corruption due to improper bounds checking and a negative packet size passed to memcpy(). The vulnerability has a CVSS score of 7.8, indicating a medium severity. A patch is available to address this issue.
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter. This vulnerability occurs when processing crafted NV12 video frames with odd width dimensions, leading to heap memory corruption. The flaw can cause process crashes or potentially allow code execution. A patch is available to address this issue.
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter. This vulnerability occurs when processing dynamically sized video streams with filtergraph reinitialization disabled, leading to heap memory corruption and potential process crashes. Depending on heap layout and process hardening, exploitation may allow code execution. A patch is available to address this issue.
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder. This vulnerability allows remote attackers to cause heap corruption by supplying a crafted AVI file that manipulates frame dimensions across TDSF frames. The issue arises because the tdsc_parse_tdsf() function does not properly unreference an existing reference frame before allocating a new buffer, leading to writes beyond the allocated buffer size. This can result in a process crash and potentially remote code execution. A patch is available to address this vulnerability.
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer. This flaw allows attackers to read memory beyond buffer boundaries by supplying a crafted DTS stream with an invalid core_size value. The vulnerability is due to a missing bounds check in the spdif_header_dts4 function during S/PDIF re-muxing of DTS-HD audio streams. This can lead to denial of service or exposure of sensitive information. A patch is available to address this issue.
Red Hat has issued a security advisory addressing multiple vulnerabilities, including CVE-2026-64834, in the ffmpeg component used in Red Hat Enterprise Linux AI 3.4 and 3.6. These vulnerabilities are rated with high severity and affect RPM packages that are internal build artifacts supported only as part of the Red Hat AI application platform. The advisory provides updated packages to remediate these issues.
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder component within libavcodec/nvdec.c. This flaw can be triggered by a crafted video file, causing memory corruption by freeing the same decoder context memory twice on an error path. The vulnerability may lead to application crashes or other impacts in FFmpeg-based applications using NVDEC hardware acceleration. A patch is available to address this issue.
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder. This vulnerability arises from improper handling of internal channel state when processing crafted ADX or AAX audio files with mid-stream channel layout changes, leading to out-of-bounds reads and writes during decoding. The flaw is identified as CVE-2026-64835 and has a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. A patch is available to address this issue.
Multiple security vulnerabilities have been identified and fixed in the ffmpeg package as part of the Red Hat Enterprise Linux AI 3.4 update. These include heap buffer overflow, double-free, out-of-bounds memory access, and information disclosure issues affecting various decoders and filters within ffmpeg. The update addresses these issues to improve the security of the ffmpeg runtime environment in RHEL AI 3.4.
FFmpeg versions 8.0 through 8.1.2 contain a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder. This vulnerability allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream with a malicious vps_num_hrd_parameters value, potentially leading to arbitrary code execution. A patch is available to address this issue.
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the lower bound (qp < 0) but is missing upper bound validation. The qp value can reach 65 (base value 63 from 6-bit frame header + offset +2 from read_qp_offset) while the rv60_qp_to_idx array has size 64 (valid indices 0-63). This results in out-of-bounds array access at lines 1554 (decode_cbp8), 1655 (decode_cbp16), and 1419/1421 (get_c4x4_set), potentially leading to memory disclosure or crash. A previous fix in commit 61cbcaf93f added validation only for intra frames. This vulnerability affects the released versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20) and is fixed in git master commit 8abeb879df which will be included in FFmpeg 8.1.