Skip to content
Threat Feed
Subscribe

Vendor

FFmpeg Project

3 briefs RSS
high threat

FFmpeg: Multiple Vulnerabilities

Multiple vulnerabilities in ffmpeg allow a remote, anonymous attacker to cause memory corruption, execute arbitrary code, trigger a denial-of-service condition, or disclose confidential information. The attacker does not require authentication to exploit these flaws.

exploited ffmpeg vulnerability rce denial-of-service information-disclosure memory-corruption
2t
high advisory

CVE-2026-66040: FFmpeg Heap Out-of-Bounds Write in PNG/APNG Encoders

A heap out-of-bounds write vulnerability, CVE-2026-66040, exists in the native PNG and APNG encoders of FFmpeg through version 8.1.2, allowing remote attackers to corrupt heap memory and achieve potential arbitrary code execution by supplying a crafted PNG image with a malicious eXIf chunk.

FFmpeg cve vulnerability heap-overflow rce
1t 1c
high advisory

Out-of-Bounds Write Vulnerability in FFmpeg vf_floodfill Filter (CVE-2026-65705)

A critical out-of-bounds write vulnerability exists in FFmpeg versions 3.4 through 8.1.2 within the vf_floodfill video filter, which attackers can exploit by providing a specially crafted, dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0, leading to heap corruption, a process crash, and potentially remote code execution.

FFmpeg versions 3.4 through 8.1.2 cve vulnerability out-of-bounds-write ffmpeg video-processing
1c