unspecified FFmpeg
45 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-90816 | 8.0.* | FFmpeg Duration hlsproto.c parse_playlist denial of service | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-90815 | 4.4.0 ; 4.4.1 ; 4.4.2 ; … | FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-12343 | 6.1 – < 8.1 | Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-10256 | 3.2 – < 8.0 | Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c) | MEDIUM 5.5 | 0.3 % | ||
| CVE-2025-7700 | < 8.0 | Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c) | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-1816 | 6e26f57f672b05e7b8b052007a83aef99dc81ccb | FFmpeg IAMF File iamf_parse.c audio_element_obu memory leak | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-1594 | 3.4.0 ; 3.4.1 ; 3.4.2 ; … | FFmpeg AAC Encoder aacenc_tns.c ff_aac_search_for_tns stack-based overflow | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-1373 | 7.0 ; 7.1 | FFmpeg MOV Parser mov.c mov_read_trak null pointer dereference | MEDIUM 4.8 | 0.3 % | ||
| CVE-2023-6605 | 2.0 – < 6.* | Ffmpeg: dash playlist ssrf vulnerability in ffmpeg | HIGH 7.2 | 0.4 % | ||
| CVE-2023-6604 | 2.0 – < 6.* | Ffmpeg: hls xbin demuxer dos amplification in ffmpeg | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-6601 | 2.0 – < 6.* | Ffmpeg: hls unsafe file extension bypass in ffmpeg | MEDIUM 4.7 | 0.4 % | ||
| CVE-2023-6603 | 3.0 – < 5.* | Ffmpeg: null pointer dereference in ffmpeg hls parsing | HIGH 7.5 | 0.6 % | ||
| CVE-2023-6602 | 2.0 – < 6.* | Ffmpeg: improper handling of input format in tty demuxer of ffmpeg | MEDIUM 5.3 | 0.5 % | ||
| CVE-2024-7272 | 5.1.0 ; 5.1.1 ; 5.1.2 ; … | FFmpeg swresample.c fill_audiodata heap-based overflow | MEDIUM 6.9 | 1.2 % | ||
| CVE-2024-7055 | 7.0.0 ; 7.0.1 | FFmpeg pnmdec.c pnm_decode_frame heap-based overflow | MEDIUM 6.9 | 1.4 % | ||
| CVE-2022-3341 | Fixed-in ffmpeg 5.1 | A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs b | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-3109 | FFmpeg 5.1 | An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and | HIGH 7.5 | 1.6 % | ||
| CVE-2022-3965 | n/a | ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds | HIGH 8.1 | 1.0 % | ||
| CVE-2022-3964 | n/a | ffmpeg QuickTime RPZA Video Encoder rpzaenc.c out-of-bounds | HIGH 8.1 | 3.8 % | ||
| CVE-2014-125025 | 2.0 | FFmpeg decode_pulses memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125024 | 2.0 | FFmpeg lag_decode_frame memory corruption | HIGH 7.8 | 0.5 % | ||
| CVE-2014-125023 | 2.0 | FFmpeg Truemotion1 truemotion1_decode_header memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125022 | 2.0 | FFmpeg Bitstream Buffer shorten_decode_frame memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125021 | 2.0 | FFmpeg cmv_process_header memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125020 | 2.0 | FFmpeg decode_update_thread_context memory corruption | HIGH 7.8 | 0.5 % | ||
| CVE-2014-125019 | 2.0 | FFmpeg Slice Segment decode_nal_unit memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125018 | 2.0 | FFmpeg decode_slice_header memory corruption | MEDIUM 5.5 | 0.6 % | ||
| CVE-2014-125017 | 2.0 | FFmpeg rpza_decode_stream memory corruption | HIGH 7.8 | 0.5 % | ||
| CVE-2014-125016 | 2.0 | FFmpeg utils.c ff_init_buffer_info memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125015 | 2.0 | FFmpeg read_var_block_data memory corruption | HIGH 7.8 | 0.5 % | ||
| CVE-2014-125014 | 2.0 | FFmpeg HEVC Video Decoder memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125013 | 2.0 | FFmpeg msrle.c msrle_decode_frame memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125012 | 2.0 | FFmpeg dxtroy.c integer coercion | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125011 | 2.0 | FFmpeg ansi.c decode_frame integer coercion | HIGH 7.8 | 0.6 % | ||
| CVE-2014-125010 | 2.0 | FFmpeg h64.c decode_slice_header memory corruption | MEDIUM 5.5 | 0.6 % | ||
| CVE-2014-125009 | 2.0 | FFmpeg snow.h add_yblock memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125008 | 2.0 | FFmpeg oggparsevorbis.c vorbis_header memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125007 | 2.0 | FFmpeg hevcpred_template.c intra_pred memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125006 | 2.0 | FFmpeg h264.c output_frame memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125005 | 2.0 | FFmpeg mpeg4videodec.c decode_vol_header memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125004 | 2.0 | FFmpeg vmnc.c decode_hextile memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125003 | 2.0 | FFmpeg jpeg2000dec.c get_siz memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2014-125002 | 2.0 | FFmpeg dnxhdenc.c dnxhd_init_rc memory corruption | MEDIUM 5.5 | 0.7 % | ||
| CVE-2022-1475 | before 4.4.2 ; before 5.0.1 | An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c wh | MEDIUM 5.5 | 0.9 % | ||
| CVE-2021-3566 | ffmpeg 4.3 | Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file t | MEDIUM 5.5 | 0.9 % |