Новые статьи
🚨 CVE-2026-125205
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B...
🚨 CVE-2026-125204
FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past...
🚨 CVE-2026-125203
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping...
🚨 CVE-2026-125202
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write...
🚨 CVE-2026-125201
FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded...
🚨 CVE-2026-125200
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded...
🚨 CVE-2026-125199
FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory...
🚨 CVE-2026-125197
FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose...
🚨 CVE-2026-125196
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes...
🚨 CVE-2026-125195
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive...
🚨 CVE-2026-125194
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing...
🚨 CVE-2026-125193
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP...
🚨 CVE-2026-125192
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer...
🚨 CVE-2026-125191
FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making...
🚨 CVE-2026-125190
FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette...
🚨 CVE-2026-125189
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an...
🚨 CVE-2026-125188
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill...
🚨 CVE-2026-125187
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly...
🚨 CVE-2026-125186
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating...
🚨 CVE-2026-125185
FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.