Cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c that allows heap memory corruption via crafted H.264 streams.

FFmpeg versions through 9.0.2 are vulnerable to a heap buffer overflow in libavcodec/exrenc.c that can cause memory corruption and application crashes during OpenEXR RLE encoding of frames exceeding initial height.

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size.

FFmpeg versions 9.0.2 and earlier are vulnerable to a heap buffer overflow in the libavcodec/flicvideo.c component, which could allow remote code execution or application crashes via crafted FLIC files.

FFmpeg versions through 9.0.2 contain an integer overflow in the cbs_jpeg_write_scan function, leading to heap buffer overflows on 32-bit architectures when processing crafted MJPEG/JPEG streams.

FFmpeg versions through 9.0.2 contain an integer overflow vulnerability in the hap_parse_frame_header function, which can be exploited by a crafted Hap video frame to cause a heap buffer overflow and potential remote code execution on 32-bit systems.

FFmpeg versions through 9.0.2 are vulnerable to a heap buffer overflow in the PSD decoder, allowing remote attackers to achieve memory corruption or arbitrary code execution via crafted PSD images on 32-bit systems.