DeutschShown in its original language — a full translation is planned for a future version.
ffmpeg: Mehrere Schwachstellen
view advisory published 2026-10-08
Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-107698US | medium5.4 | — | ||
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without v… | ||||
| CVE-2026-107697US | medium4.3 | — | ||
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playl… | ||||
| CVE-2026-107696US | medium6.5 | — | ||
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers contro… | ||||
| CVE-2026-107695US | medium6.5 | — | ||
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playl… | ||||
| CVE-2026-107678US | medium4.7 | — | ||
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked… | ||||
| CVE-2026-107677US | medium4.7 | — | ||
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media UR… | ||||
| CVE-2026-107676US | low3.3 | — | ||
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping… | ||||
| CVE-2026-107675US | medium5.9 | — | ||
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Att… | ||||
| CVE-2026-107660US | medium4.8 | — | ||
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-ad… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
- GitHub Advisory Database vom 2026-10-08external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan