[ Vendor · 10 CVEs ]
FFmpeg
CVEs affecting FFmpeg published in the last 30 days, plus any FFmpeg CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107696 | 8 Oct 2026 | CVSS 6.5 | FFmpegFFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any… | Fix |
| CVE-2026-107697 | 8 Oct 2026 | CVSS 4.3 | FFmpegFFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions… | Fix |
| CVE-2026-107698 | 8 Oct 2026 | CVSS 5.4 | FFmpegFFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that… | Fix |
| CVE-2026-107695 | 8 Oct 2026 | CVSS 6.5 | FFmpegFFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because… | Fix |
| CVE-2026-107675 | 8 Oct 2026 | CVSS 5.9 | FFmpegFFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers… | Fix |
| CVE-2026-107676 | 8 Oct 2026 | CVSS 3.3 | FFmpegFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes… | Fix |
| CVE-2026-107677 | 8 Oct 2026 | CVSS 4.7 | FFmpegFFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an… | Fix |
| CVE-2026-107678 | 8 Oct 2026 | CVSS 4.7 | FFmpegFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively… | Fix |
| CVE-2026-107660 | 8 Oct 2026 | CVSS 4.8 | FFmpegFFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which… | Fix |
| CVE-2026-96611 | 23 Sep 2026 | CVSS 7.8 | FFmpegFFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box… | Fix |