FFmpeg vulnerabilities and fixes

CVEs that mention FFmpeg, ranked by priority. 12 tracked.

FFmpeg has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-10-14. Highest priority: CVE-2026-66041 (score 46/100).

• CVE-2026-66041 HIGH 8.8 UPGRADE FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf
• CVE-2026-64831 HIGH 8.8 UPGRADE FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware d
• CVE-2026-64834 HIGH 7.5 UPGRADE FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libav
• CVE-2026-64830 HIGH 8.8 UPGRADE FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer
• CVE-2026-64835 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decode
• CVE-2026-64832 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder wit
• CVE-2026-110837 HIGH 7.1 UPGRADE FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer ove
• CVE-2026-64833 HIGH 7.1 UPGRADE FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allow
• CVE-2026-65703 HIGH 7.8 UPGRADE FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that
• CVE-2026-65705 HIGH 7.8 UPGRADE FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filte
• CVE-2026-65706 HIGH 7.8 UPGRADE FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter
• CVE-2026-71212 MEDIUM 4.4 xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and dow

FAQ

How do I fix FFmpeg vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is FFmpeg being exploited right now?

None of the tracked FFmpeg CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which FFmpeg CVE should I patch first?

CVE-2026-66041 currently ranks highest (46/100): FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf.

← Back to latest CVEs