# FFmpeg vulnerabilities

Source: https://junglewise.ai/threats/technologies/ffmpeg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 21:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/ffmpeg.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 148 vulnerabilities in FFmpeg: 92 in the last 7 days and 122 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125270, was published on 9 November 2026. 7 vulnerabilities in the last four weeks, up 133% on the four before (3).

## Counts

- Last 7 days: 92
- Last 30 days: 99
- Last 90 days: 122
- All time: 148 (3 critical, 0 exploited in the wild)

## About FFmpeg

Multimedia framework for encoding, decoding, and manipulating audio and video files.

## Latest FFmpeg vulnerabilities

- [CVE-2026-125270: FFmpeg heap out-of-bounds read in v4l2_buffers](https://junglewise.ai/threats/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-125269: FFmpeg double free in H.264 SEI message handling](https://junglewise.ai/threats/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125267: FFmpeg heap out-of-bounds write in APAC decoder](https://junglewise.ai/threats/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-125265: FFmpeg use-after-free in NVIDIA codec decoding](https://junglewise.ai/threats/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-125264: FFmpeg JPEG XL parser uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource) (medium, CVSS 5.5, published 9 Nov 2026)
- [CVE-2026-125263: FFmpeg LCEVC dimension validation bypass memory exhaustion](https://junglewise.ai/threats/cve-2026-125263-ffmpeg-9-0-through-9-0-2-built-with-liblcevc-dec-fails-to) (medium, CVSS 4.7, published 9 Nov 2026)
- [CVE-2026-125262: FFmpeg heap buffer overflow in LCEVC decoder](https://junglewise.ai/threats/cve-2026-125262-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-125261: FFmpeg SGI encoder out-of-bounds read in encode_frame()](https://junglewise.ai/threats/cve-2026-125261-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read) (medium, CVSS 6.1, published 9 Nov 2026)
- [CVE-2026-125260: FFmpeg heap buffer overflow in libavcodec/exrenc.c](https://junglewise.ai/threats/cve-2026-125260-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125259: FFmpeg integer overflow in prores_kostya encoder](https://junglewise.ai/threats/cve-2026-125259-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-125258: FFmpeg division by zero in dovi_configure_ext](https://junglewise.ai/threats/cve-2026-125258-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability) (medium, CVSS 4.7, published 9 Nov 2026)
- [CVE-2026-125257: FFmpeg off-by-one heap overflow in Nellymoser encoder](https://junglewise.ai/threats/cve-2026-125257-ffmpeg-through-9-0-2-contains-an-off-by-one-heap-overflow) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125256: FFmpeg heap buffer overflow in Huffyuv encoder](https://junglewise.ai/threats/cve-2026-125256-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125255: FFmpeg use-after-free in MJPEG decoder with hardware acceleration](https://junglewise.ai/threats/cve-2026-125255-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-125254: FFmpeg division by zero in VVC decoder](https://junglewise.ai/threats/cve-2026-125254-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability) (medium, CVSS 5.5, published 9 Nov 2026)
- [CVE-2026-125253: FFmpeg integer overflow in VP9 superframe parsing](https://junglewise.ai/threats/cve-2026-125253-ffmpeg-through-9-0-2-contains-an-integer-overflow-in-cbs-vp9) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-125252: FFmpeg memory leak in VAAPI decode](https://junglewise.ai/threats/cve-2026-125252-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in) (medium, CVSS 4.7, published 9 Nov 2026)
- [CVE-2026-125251: FFmpeg integer overflow in VVC decoder alloc_frame()](https://junglewise.ai/threats/cve-2026-125251-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125250: FFmpeg heap buffer overflow in GIF encoder](https://junglewise.ai/threats/cve-2026-125250-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-in-the-gif) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-125249: FFmpeg integer overflow in Vulkan decode slice handling](https://junglewise.ai/threats/cve-2026-125249-ffmpeg-7-1-through-9-0-2-contains-an-integer-overflow-in-ff-vk) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125248: FFmpeg integer overflow in Vulkan FFV1 encoder](https://junglewise.ai/threats/cve-2026-125248-ffmpeg-9-0-through-9-0-2-contains-an-integer-overflow) (high, CVSS 7, published 9 Nov 2026)
- [CVE-2026-125246: FFmpeg denial of service in JPEG bitstream parsing](https://junglewise.ai/threats/cve-2026-125246-ffmpeg-through-9-0-2-contains-a-denial-of-service-vulnerability) (medium, CVSS 4.7, published 9 Nov 2026)
- [CVE-2026-125245: FFmpeg memory leak in MJPEG hardware acceleration](https://junglewise.ai/threats/cve-2026-125245-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-ff) (medium, CVSS 4.7, published 9 Nov 2026)
- [CVE-2026-125244: FFmpeg out-of-bounds write in VVC decoder sh_entry_points](https://junglewise.ai/threats/cve-2026-125244-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-an-out-of) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-125242: FFmpeg memory leak in VDPAU decoder in libavcodec](https://junglewise.ai/threats/cve-2026-125242-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in) (medium, CVSS 4.7, published 9 Nov 2026)

## Most severe FFmpeg vulnerabilities

- [CVE-2026-22778: vLLM remote code execution via JPEG2000 heap overflow and ASLR bypass](https://junglewise.ai/threats/cve-2026-22778-vllm-remote-code-execution-via-jpeg2000-heap-overflow-and-aslr) (critical, CVSS 9.8, published 2 Feb 2026)
- [CVE-2026-75143: FFmpeg heap buffer overflow in RIST protocol reader](https://junglewise.ai/threats/cve-2026-75143-ffmpeg-heap-buffer-overflow-in-rist-protocol-reader) (critical, CVSS 9.8, published 19 Aug 2026)
- [CVE-2016-6164: FFmpeg integer overflow in mov_build_index function](https://junglewise.ai/threats/cve-2016-6164-ffmpeg-integer-overflow-in-mov-build-index-function) (critical, CVSS 9.8, published 23 Jan 2017)
- [CVE-2026-30754: FFmpeg memory corruption in RTP H.264/HEVC encoding](https://junglewise.ai/threats/cve-2026-30754-ffmpeg-memory-corruption-in-rtp-h-264-hevc-encoding) (high, CVSS 8.8, published 8 Sep 2026)
- [CVE-2026-8461: FFmpeg libavcodec out-of-bounds write in MagicYUV decoder](https://junglewise.ai/threats/cve-2026-8461-ffmpeg-libavcodec-out-of-bounds-write-in-magicyuv-decoder) (high, CVSS 8.8, published 18 Jun 2026)
- [CVE-2026-66041: FFmpeg heap out-of-bounds write in vf_quirc filter](https://junglewise.ai/threats/cve-2026-66041-ffmpeg-heap-out-of-bounds-write-in-vf-quirc-filter) (high, CVSS 8.8, published 24 Jul 2026)
- [CVE-2026-66040: FFmpeg heap out-of-bounds write in PNG and APNG encoders](https://junglewise.ai/threats/cve-2026-66040-ffmpeg-heap-out-of-bounds-write-in-png-and-apng-encoders) (high, CVSS 8.8, published 24 Jul 2026)
- [CVE-2026-66039: FFmpeg signed integer overflow in MACE6 audio decoder](https://junglewise.ai/threats/cve-2026-66039-ffmpeg-signed-integer-overflow-in-mace6-audio-decoder) (high, CVSS 8.8, published 24 Jul 2026)
- [CVE-2026-66036: FFmpeg heap out-of-bounds write in vf_hqdn3d filter](https://junglewise.ai/threats/cve-2026-66036-ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter) (high, CVSS 8.8, published 24 Jul 2026)
- [CVE-2026-64835: FFmpeg OOB memory access in ADX audio decoder](https://junglewise.ai/threats/cve-2026-64835-ffmpeg-oob-memory-access-in-adx-audio-decoder) (high, CVSS 8.8, published 22 Jul 2026)

## Vulnerabilities per week

7 vulnerabilities in the last four weeks, up 133% on the four before (3).

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 7 | 1 | 0 |
| 24 Aug 2026 | 9 | 0 | 0 |
| 31 Aug 2026 | 1 | 0 | 0 |
| 7 Sep 2026 | 3 | 0 | 0 |
| 14 Sep 2026 | 2 | 0 | 0 |
| 21 Sep 2026 | 1 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 1 | 0 | 0 |
| 26 Oct 2026 | 6 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 92 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FFmpeg vulnerabilities", https://junglewise.ai/threats/technologies/ffmpeg, 9 November 2026.