PatchTheCVEffmpeg vulnerabilities and fixes
Recent CVEs affecting ffmpeg, with upgrade or downgrade steps. 10 tracked.
ffmpeg has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-07-24. Highest priority: CVE-2026-66041 (score 46/100).
- CVE-2026-64831 HIGH 8.8 UPGRADE FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware d
- CVE-2026-64834 HIGH 7.5 UPGRADE FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libav
- CVE-2026-64830 HIGH 8.8 UPGRADE FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer
- CVE-2026-64835 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decode
- CVE-2026-64832 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder wit
- CVE-2026-64833 HIGH 7.1 UPGRADE FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allow
- CVE-2026-65703 HIGH 7.8 UPGRADE FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that
- CVE-2026-65705 HIGH 7.8 UPGRADE FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filte
- CVE-2026-65706 HIGH 7.8 UPGRADE FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter
- CVE-2026-66041 HIGH 8.8 UPGRADE FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf
FAQ
How do I fix ffmpeg vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ffmpeg being exploited right now?
None of the tracked ffmpeg CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ffmpeg CVE should I patch first?
CVE-2026-66041 currently ranks highest (46/100): FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf.