How many CVEs does FFmpeg have?

FFmpeg has 497 published CVE records since 2005, including 35 in the last two years.

How many FFmpeg CVEs are in CISA KEV?

None of FFmpeg's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which FFmpeg products have the most CVEs?

The FFmpeg products with the most published CVEs are FFmpeg, libavcodec, EXR decoder, FFmpeg 8.0, FFmpeg 8.0.1.

What are the most common weakness types in FFmpeg CVEs?

FFmpeg's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow), CWE-476 (NULL Pointer Dereference).

Are there public exploits for FFmpeg vulnerabilities?

Yes — 28 of FFmpeg's CVEs have a known public exploit.

How many critical FFmpeg vulnerabilities are there?

FFmpeg has 106 critical and 157 high-severity CVEs.

What is the average severity of FFmpeg CVEs?

The average CVSS base score across FFmpeg's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

497 CVEs

FFmpeg Vulnerabilities

Name: FFmpeg vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for FFmpeg.

497

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

28

Public exploits

PoC or exploit code

7.4

Avg CVSS

2005–2026

Overview

FFmpeg has 497 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 28 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting FFmpeg products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on FFmpeg's vulnerability posture, as a share of its 497 published CVEs.

Average CVSS: 7.4
Critical / high: 53%
Actively exploited (KEV): 0%
Public exploit available: 6%
Patch available: 81%

Severity and exploitation

How the CVSS severity of FFmpeg's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical106

High157

Medium230

Low4

In CISA’s Known Exploited Vulnerabilities catalog

0

None of FFmpeg's CVEs are currently listed in CISA's KEV catalog.

Public exploits

28

28 of FFmpeg's CVEs have a known public exploit available.

Most affected products

The FFmpeg products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in FFmpeg CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish FFmpeg CVE records.

Disclosure activity by year

How many FFmpeg CVEs were published each year.

2019

11

2020

4

2021

65

2022

29

2023

6

2024

37

2025

26

2026

9

Latest FFmpeg CVEs

The most recently disclosed vulnerabilities affecting FFmpeg.

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
CWE-787
High · CVSS 8.8
EPSS 0.2%2026-06-28
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
CWE-787
High · CVSS 8.8
EPSS 0.5%2026-06-18
Critical vulnerability · 2026-04-16
CWE-190
Critical · CVSS 9.8
EPSS 0.1%2026-04-16
High vulnerability · 2026-04-13
CWE-400
High · CVSS 7.5
EPSS 0.4%2026-04-13
High vulnerability · 2026-04-13
CWE-122
High · CVSS 7.5
EPSS 0.5%2026-04-13
High vulnerability · 2026-04-13
CWE-125
High · CVSS 7.5
EPSS 0.3%2026-04-13
Medium vulnerability · 2026-03-16
CWE-125
Medium · CVSS 5.4
EPSS 0.3%2026-03-16
Ffmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend
CWE-415
Medium · CVSS 5.5
EPSS 0.1%2026-02-18
Ffmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)
CWE-476
Medium · CVSS 5.5
EPSS 0.3%2026-02-18
High vulnerability · 2025-12-18
CWE-190
High · CVSS 7.5
EPSS 0.3%2025-12-18
Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)
CWE-476
Medium · CVSS 5.3
EPSS 0.3%2025-11-07
Heap-buffer-overflow write in FFmpeg SANM process_ftch
CWE-416
High · CVSS 8.7
EPSS 0.2%2025-10-06

Track new FFmpeg CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor FFmpeg CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Lenovo519 CVEs Xen Project514 CVEs ivanti502 CVEs AMD501 CVEs HCL496 CVEs fabian483 CVEs HCLTech474 CVEs Atlassian471 CVEs

Browse all vendors

Frequently asked questions

Common questions about FFmpeg vulnerabilities.

How many CVEs does FFmpeg have?: FFmpeg has 497 published CVE records since 2005, including 35 in the last two years.
How many FFmpeg CVEs are in CISA KEV?: None of FFmpeg's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which FFmpeg products have the most CVEs?: The FFmpeg products with the most published CVEs are FFmpeg, libavcodec, EXR decoder, FFmpeg 8.0, FFmpeg 8.0.1.
What are the most common weakness types in FFmpeg CVEs?: FFmpeg's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow), CWE-476 (NULL Pointer Dereference).
Are there public exploits for FFmpeg vulnerabilities?: Yes — 28 of FFmpeg's CVEs have a known public exploit.
How many critical FFmpeg vulnerabilities are there?: FFmpeg has 106 critical and 157 high-severity CVEs.
What is the average severity of FFmpeg CVEs?: The average CVSS base score across FFmpeg's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track FFmpeg vulnerabilities

Monitor new FFmpeg vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing