Skip to content

Ffmpeg · weakness class

Other weaknesses

36 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execut…CVE-2009-4633Ffmpeg · 7.9% likely

    CWE-189

  2. Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation…CVE-2009-4634Ffmpeg · 7.2% likely

    CWE-189

  3. Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file that trig…CVE-2009-4631Ffmpeg · 5.1% likely

    CWE-189

  4. Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an…CVE-2009-4640Ffmpeg · 4.0% likely

    CWE-189

  5. Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.CVE-2009-4638Ffmpeg · 3.9% likely

    CWE-189

  6. The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an…CVE-2013-0875Ffmpeg · 3.6% likely

    CWE-189

  7. Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote att…CVE-2011-3362Ffmpeg · 3.4% likely

    CWE-189

  8. libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denia…CVE-2014-8545Ffmpeg · 3.1% likely

    CWE-189

  9. Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other imp…CVE-2014-8546Ffmpeg · 3.1% likely

    CWE-189

  10. The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero err…CVE-2009-4639Ffmpeg · 3.0% likely

    CWE-189

  11. Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples pe…CVE-2013-0855Ffmpeg · 3.0% likely

    CWE-189

  12. The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspe…CVE-2013-0864Ffmpeg · 2.8% likely

    CWE-189

  13. Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have u…CVE-2013-7010Ffmpeg · 2.7% likely

    CWE-189

  14. Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial o…CVE-2011-3974Ffmpeg · 2.5% likely

    CWE-189

  15. Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact vi…CVE-2013-0876Ffmpeg · 2.4% likely

    CWE-189

  16. The wavpack_decode_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted WavPack data, which triggers an ou…CVE-2013-0853Ffmpeg · 2.4% likely

    CWE-189

  17. Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which…CVE-2013-0844Ffmpeg · 2.4% likely

    CWE-189

  18. The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of servic…CVE-2015-8216Ffmpeg · 2.4% likely

    CWE-17

  19. The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (seg…CVE-2015-6823Ffmpeg · 2.4% likely

    CWE-17

  20. The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to…CVE-2015-6822Ffmpeg · 2.4% likely

    CWE-17

  21. Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bound…CVE-2015-6819Ffmpeg · 2.4% likely

    CWE-189

  22. The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote a…CVE-2015-6818Ffmpeg · 2.4% likely

    CWE-17

  23. libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check for a zero value of a slice height, which allows remote attackers to cause a denial of service (out-of-bounds array a…CVE-2014-9604Ffmpeg · 2.4% likely

    CWE-189

  24. libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a denial of service (out-of-bounds access…CVE-2014-8549Ffmpeg · 2.4% likely

    CWE-189

  25. oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of s…CVE-2009-4632Ffmpeg · 2.1% likely

    CWE-189

  26. The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a negative or zero count value in a TIFF imag…CVE-2013-0859Ffmpeg · 2.1% likely

    CWE-189

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.