Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423974 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125214 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer. | ||||
| CVE-2026-125213 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution. | ||||
| CVE-2026-125212 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with VideoToolbox encoders without rescaling, to crash the application or corrupt memory. | ||||
| CVE-2026-125211 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap. | ||||
| CVE-2026-125210 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory. | ||||
| CVE-2026-125209 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7.8 High |
| FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory. | ||||
| CVE-2026-125208 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding. | ||||
| CVE-2026-125206 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 2.5 Low |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane. | ||||
| CVE-2026-125204 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past the stale reference frame and crash applications. | ||||
| CVE-2026-125203 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7.8 High |
| FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing cook_decode_frame() to write decoded samples beyond allocated output planes in any application decoding the file. | ||||
| CVE-2026-125202 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI. | ||||
| CVE-2026-125201 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware accelerator to overflow tile_sizes and corrupt heap memory. | ||||
| CVE-2026-125198 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 2.5 Low |
| FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion. | ||||
| CVE-2026-125197 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 6.1 Medium |
| FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application. | ||||
| CVE-2026-125196 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers. | ||||
| CVE-2026-125195 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 2.5 Low |
| FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process. | ||||
| CVE-2026-125193 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 6.1 Medium |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory. | ||||
| CVE-2026-125192 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 3.3 Low |
| FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames. | ||||
| CVE-2026-125190 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 3.3 Low |
| FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames. | ||||
| CVE-2026-125188 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 2.5 Low |
| FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output. | ||||