F
Vendor security profile
ffmpeg
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs45
Critical1
CISA KEV0
Public exploit5
Patch rate%87
Avg. CVSS7.0
12-month vulnerability rate
0
1
0
0
0
0
0
1
16
12
6
9
CVE KEV
CVE severity distribution
45toplam CVE
Critical1 (2%)
High24 (53%)
Medium17 (38%)
Low3 (7%)
Patch and exploitation view
%87
Verified patch
%0
CISA KEV
%11
Public exploit
39Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
5.3
CVE-2026-107698
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
F
Patch verifiedEPSS %0
5.3
CVE-2026-107697
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
F
Patch verifiedEPSS %0
7.1
CVE-2026-107696
FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
F
Patch verifiedEPSS %0
7.1
CVE-2026-107695
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
F
Patch verifiedEPSS %0
5.7
CVE-2026-107678
FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
F
Patch status unknownEPSS %0
5.7
CVE-2026-107677
FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
F
Patch verifiedEPSS %0
4.8
CVE-2026-107676
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
F
Patch verifiedEPSS %0
6.0
CVE-2026-107675
FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
F
Patch verifiedEPSS %0
6.3
CVE-2026-107660
FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
F
Patch verifiedEPSS %0
6.9
CVE-2026-96611
Integer overflow in FFmpeg
F
Patch status unknownEPSS %0