FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2bufferswframetobuf() in libavcodec/v4l2buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbssei.c where cbsseideletemessage() leaves a stale extensiondata reference that ffcbsseiaddmessage() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264metadata with displayorientation=insert, to corrupt heap memory.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwttmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader() in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the parser loop excessively and exhaust CPU.

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2() allocations and exhaust memory.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encodeframe() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encodescanlinerle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ffproreskostyaencodeinit() that miscalculates framesizeupperbound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the proresks encoder, causing encodeframe() to write slices past an undersized packet buffer and corrupt heap memory.

FFmpeg through 9.0.2 contains a division by zero vulnerability in doviconfigureext() in libavcodec/dovirpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovirpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in getexponentdynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPTSIZE and overwrite adjacent heap memory.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ffllvidencdiffbytesrvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl() fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale(), crashing the decoding process.

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ffmjpegdecodesof() to pass a stale rawimagebuffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.

FFmpeg through 9.0.2 contains an integer overflow in cbsvp9splitfragment() in libavcodec/cbsvp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapidecode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.

FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gifimagewriteimage() in libavcodec/gif.c because shrunkbuf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remapframetopalette() to write past shrunkbuf and corrupt the heap during GIF transcoding.

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ffvkdecodeaddslice() in libavcodec/vulkandecode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1encvulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.

FFmpeg through 9.0.2 contains an integer overflow vulnerability in dngdecodetiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INTMAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbsjpegassemblefragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an avassert0 abort when CBS-based bitstream filters process it.

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entrypointstartctu and corrupting decoder memory.

FFmpeg through 9.0.2 contains a memory leak vulnerability in ffmjpegdecodesof() in libavcodec/mjpegdec.c, which overwrites the hwaccelpictureprivate pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ffjpeglsdecodepicture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before endframe. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstreambuffers table continuously and causing denial of service.

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because checkpixelptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code.