OESA-2026-3288

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Buffer Overflow vulnerability exists in FFmpeg 4.1 via apngdoinverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service(CVE-2020-21041)

A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filterframe at libavfilter/vfbitplanenoise.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22023)

Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfunframe16 function in libavfilter/vflagfun.c, which could let a remote malicious user cause Denial of Service.(CVE-2020-22024)

Buffer Overflow vulnerability exists in FFmpeg 4.2 in filtervertically8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service.(CVE-2020-22028)

A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vfw3fdif.c in filter16complex_low, which might lead to memory corruption and other potential consequences.(CVE-2020-22031)

A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vfedgedetect.c in gaussianblur, which might lead to memory corruption and other potential consequences.(CVE-2020-22032)

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in getblockrow at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22035)

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filterintra at libavfilter/vfbwdif.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22036)

A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the vframealloc function in frame.c.(CVE-2020-22040)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avbuffersrcaddframeflags function in buffersrc.(CVE-2020-22041)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ffframepool_get function in framepool.c.(CVE-2020-22048)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the configinput function in afacrossover.c.(CVE-2020-22056)

decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.(CVE-2020-35965)

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.(CVE-2025-9951)