FFmpeg vulnerabilities and threats

CVE-2026-125064 is a vulnerability in FFmpeg up to version 9.0.2 where the g726_decode_frame() function in libavcodec/g726.c does not properly handle oversized packets, leading to a NULL pointer dereference. An attacker can craft an AVI file with a large G.726 audio chunk to cause the decoder to read from a NULL buffer and crash the process.

FFmpeg versions 2.3 through 9.0.2 have a vulnerability in the Huffyuv decoder where uninitialized heap memory can be leaked into decoded video frames. This occurs when processing crafted Huffyuv BGR24/BGRA videos with entropy data that ends prematurely, causing uninitialized data to be included in output frames.

CVE-2026-120246 is a use of uninitialized variable vulnerability in FFmpeg versions 4.4 through 9.0.2 affecting the CDXL decoder. This flaw causes stack memory to leak into decoded pixels via unfilled HAM palette entries, potentially exposing sensitive stack bytes and pointer fragments in the output. The vulnerability arises when processing crafted type-0 CDXL files that select unfilled palette entries during decoding.

CVE-2026-120245 is a use of uninitialized resource vulnerability in FFmpeg versions 0.10 through 9.0.2. It occurs in the sunrast_decode_frame() function when decoding truncated 1-bit and 4-bit paletted Sun Raster images, causing heap memory leakage. An attacker can craft a malformed Sun Raster file to expose stale heap contents in the decoded output.

A use of uninitialized resource vulnerability exists in FFmpeg versions 2.1 through 9.0.2 in the PCX image decoder. This flaw allows an attacker to craft a specially truncated PCX image with early-ending RLE data, causing the decoder to leak heap memory by copying uninitialized buffer contents into decoded pixels. The vulnerability has a medium severity score of 6.8 and requires user interaction with locally accessible files.

CVE-2026-120243 is a vulnerability in FFmpeg versions 2.0 through 9.0.2 involving the use of an uninitialized variable in the Go2Meeting decoder. This flaw allows attackers to leak stack memory by crafting a specially formed G2M3/G2M4 stream with a short Kempf palette, causing uninitialized stack bytes, including sensitive data like pointers or stack guards, to be copied into the decoded output.

FFmpeg versions 5.0 through 9.0.2 have a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to use crafted IMF packages with specially crafted ASSETMAP Path elements containing '..' or absolute paths to access files outside the intended directory. Exploitation can lead to unauthorized reading of local MXF files, including probing for file existence and size, or triggering server-side requests.

CVE-2026-75147 is an out-of-bounds read vulnerability in FFmpeg's AV1 RTP packetizer component. It occurs due to improper bounds checking when processing the OBU size in AV1 RTP packets, leading to a pointer dereference beyond the packet buffer. This flaw affects FFmpeg versions prior to the commit 983dae9. The vulnerability has a medium severity with a CVSS score of 6.9.

CVE-2026-75146 is an out-of-bounds read vulnerability in FFmpeg's DASH demuxer. It occurs when a live DASH manifest is refreshed with a startNumber lower than the previous one, causing the sequence number to become negative. This negative index is then used to access the fragments array without proper lower bound checks, leading to an out-of-bounds read. This can be triggered by a malicious or misconfigured DASH server serving a manifest with a decreasing startNumber.

CVE-2026-75145 is a vulnerability in FFmpeg's AV1 RTP packetizer where an incorrect integer narrowing conversion causes an oversized OBU size to be treated as a negative value on certain platforms. This bypasses payload size checks and leads to out-of-bounds memory access during copy operations.

A heap-based buffer overflow vulnerability exists in FFmpeg's VC-2/Dirac RTP packetizer component before commit 1cdeb3c. This flaw occurs because the packetizer copies a size value derived from input data into a fixed-size buffer without checking upper bounds, allowing crafted Dirac data units to cause memory corruption.

A heap-based buffer overflow vulnerability exists in FFmpeg's RIST protocol reader (libavformat/librist.c) before commit 1c10bcc. The function librist_read() improperly handles the size argument, copying the full payload length into a smaller destination buffer, which can be triggered remotely via the async:rist:// URL scheme by a malicious RIST sender. This vulnerability has a critical severity with a CVSS 4.0 score of 9.3.

CVE-2026-75142 is a stack-based buffer overflow vulnerability in FFmpeg's MPEG-PS muxer component. It occurs when muxing input containing more streams than the fixed-size stack buffer can handle, leading to an overflow. This vulnerability affects FFmpeg versions before commit 9d786e4. The flaw can be triggered by crafted inputs with an excessive number of streams during MPEG-PS muxing.

CVE-2026-75141 is a heap-based buffer overflow vulnerability in FFmpeg's hvcC box writer. It occurs when writing an HEVC configuration record with more NAL units of a single type than the count field can represent, causing an overflow of the NAL unit count and subsequently a heap buffer overflow. This flaw can be triggered by a crafted HEVC input file during muxing.

CVE-2025-59728 is a high-severity vulnerability in FFmpeg's MPEG-DASH handling where an out-of-bounds write occurs due to improper buffer management when appending a '/' character to a string buffer. This results in a NUL-byte being written one byte past the allocated buffer end. The issue affects versions prior to 8.0. No known exploits are reported in the wild as of the publication date.

CVE-2025-0518 is a medium severity vulnerability in FFmpeg version 7.1 involving unchecked return values and an out-of-bounds read in the af_pan filter source code. This flaw could allow reading sensitive constants within an executable. The issue was discovered by Simcha Kosman and has been fixed in a subsequent commit.