FFmpeg versions prior to 8.1.3 contain a vulnerability in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions. This occurs when a crafted master playlist includes child playlists using disallowed protocols or non-multimedia local files, causing the parse_playlist() function to open resources that should be blocked by the HLS security policy. The vulnerability has a medium severity with a CVSS score of 4.3.
FFmpeg versions before 7.1.4 and 8.0.x before 8.0.2 contain a server-side request forgery (SSRF) vulnerability in the ff_rtsp_connect() function within libavformat/rtsp.c. This vulnerability allows malicious RTSP servers to redirect FFmpeg to internal hosts and ports using other schemes, bypassing the -protocol_whitelist option. The issue is tracked as CVE-2026-107698 and has a medium severity rating with a CVSS score of 5.4.
FFmpeg versions up to 9.0.2 contain an infinite loop vulnerability in the ff_rtsp_connect() function of libavformat/rtsp.c. This occurs because the function follows RTSP 3xx redirect responses without limiting the number of redirects. An attacker controlling an RTSP server can exploit this by sending repeated 302 redirects, causing the client to enter an endless reconnect loop that saturates a CPU core. The vulnerability has a CVSS score of 6.5, indicating medium severity.
FFmpeg versions prior to 8.1.3 contain an infinite loop vulnerability in the HLS demuxer. This flaw allows remote attackers to cause a denial of service by exploiting the parse_playlist() function, which improperly accepts Master Playlist tags inside Media Playlists. Crafted self-referencing playlists can cause unbounded CPU and I/O consumption, leading to service disruption.
FFmpeg versions through 9.0.2 contain a denial of service vulnerability in the DASH demuxer. An attacker can trigger an infinite loop by supplying an empty SegmentTemplate media URL in an .mpd manifest, causing excessive CPU consumption and resulting in a denial of service condition.
FFmpeg versions through 9.0.2 contain an uninitialized memory disclosure vulnerability in the av_dynamic_hdr_plus_to_t35() function. This flaw causes up to three payload bytes to remain uninitialized when the tone_mapping_flag is set to 0. An attacker can exploit this by supplying crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata, leading to leaked process memory being written into output files during remuxing or transcoding. The vulnerability has a medium severity with a CVSS score of 3.3.
FFmpeg versions through 9.0.2 contain a stack exhaustion vulnerability in the av_encryption_init_info_free() function of libavutil/encryption_info.c. This vulnerability arises from recursive freeing of linked lists created by the MOV demuxer's mov_read_pssh(). An attacker can exploit this by crafting an MP4 file with many small pssh boxes, leading to stack exhaustion, process crashes, and high CPU usage.
FFmpeg versions through 9.0.2 contain a vulnerability in the libssh-based SFTP protocol handler due to missing host key verification. This flaw allows network attackers capable of man-in-the-middle, DNS, or ARP spoofing attacks to impersonate SFTP servers. Exploitation can lead to interception of passwords used in sftp URLs, delivery of forged media content, or interception of uploaded data.
A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
FFmpeg versions prior to 9.0 have an out-of-bounds read vulnerability in the WMA extradata allocation paths within libavcodec/wmaenc.c due to missing required padding. This flaw can cause a denial of service but does not affect confidentiality or integrity.
FFmpeg versions prior to 9.0 contain an out-of-bounds read vulnerability in the MOV parsing path due to insufficient padding of extradata in the mov_read_iacb function. This vulnerability can cause a denial of service but does not affect confidentiality or integrity.
CVE-2026-30754 is a high severity memory corruption vulnerability in FFmpeg versions before 8.1. It occurs in the RTP encoding process, specifically in the nal_send function of libavformat/rtpenc_h264_hevc.c, where a negative size parameter is passed to memcpy when handling crafted H.264/HEVC RTP streams. This flaw was identified using AddressSanitizer.
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder. This vulnerability allows an attacker who can supply a crafted TIFF file with a valid Deflate-compressed strip that decompresses fewer bytes than declared to cause stale heap data to be included in the decoded image output, potentially exposing sensitive data. The vulnerability has a medium severity with a CVSS score of 5.5. A patch is available to address this issue.
FFmpeg versions from 3.0 up to, but not including, 9.0 contain a vulnerability in the native Screenpresso decoder that allows reading uninitialized heap memory. This occurs because the decoder does not validate the decompressed byte count before copying frame data, potentially exposing sensitive memory contents such as userspace addresses. The vulnerability can be triggered by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than expected. A fix is available through updated packages provided by Ubuntu Pro via Extended Security Maintenance (ESM).
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder. This vulnerability allows an attacker to disclose heap memory contents by providing a crafted video file with a compressed tile that decompresses fewer bytes than expected. The flaw occurs because the decompressed byte count is not validated against the tile dimensions before copying data, potentially exposing data from prior heap allocations or previously decoded frames. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity). A patch is available for this issue.
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder. This vulnerability allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The flaw is due to the cfhd_decode() function not enforcing a logical output-width invariant, leading to writes beyond the allocated output buffer. Ubuntu has issued security advisories and provides patches for affected versions in their LTS releases.
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser. This vulnerability is identified as CVE-2026-70628 and has been fixed in the ffmpeg-4-4.4.8-5.1 package on openSUSE Tumbleweed. The CVSS 3.1 base score is 7.8, indicating a medium severity issue.