FFmpeg

Mentions · 7d4
Mentions · 30d5
All mentions9
First seenSep 6, 2026
Last mentioned3d ago

Timeline

9 articles · newest first

Brotli decoder bug allows remote code execution (CVE-2026-111497)

ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.

Help Net Securityupdated Oct 28, 08:37 UTC · 2d agofirst Oct 27, 17:38 UTC · 3d agoExploit / PoCExploited30 sourcesCVE-2026-1114973 · 1 read

Google Brotli decoder CVE-2026-111497 can yield remote code execution

Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.

Tenable Blogupdated Oct 28, 08:37 UTC · 2d agofirst Oct 27, 01:19 UTC · 4d agoVulnerability 30 sourcesCVE-2026-1114971

Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497

The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.

The Register · Securityupdated Oct 28, 08:37 UTC · 2d agofirst Oct 26, 17:58 UTC · 4d agoVulnerability 30 sourcesCVE-2026-111497

Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow

JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.

Cyber Security Newsupdated Oct 28, 08:37 UTC · 2d agofirst Oct 26, 06:35 UTC · 4d agoVulnerability 30 sourcesCVE-2026-1114971

USN-8915-1: FFmpeg vulnerabilities

Ubuntu's USN-8915-1 fixes FFmpeg flaws, including possible code execution and several denial-of-service bugs.

Ubuntu Security NoticesOct 12, 23:14 UTC · 18d agoAdvisoryCVE-2026-30754 CVE-2026-38344 CVE-2026-38346+23 · 1 read

USN-8716-2: FFmpeg vulnerabilities

Ubuntu issued USN-8716-2 fixing FFmpeg VobSub, Vulkan HEVC, and NVDEC decoder flaws that could allow denial of service or code execution.

Ubuntu Security NoticesSep 9, 17:27 UTC · Sep 9, 2026AdvisoryCVE-2026-64830 CVE-2026-648311 · 1 read

USN-8738-1: FFmpeg vulnerabilities

Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.

Ubuntu Security Noticesupdated Sep 8, 17:12 UTC · Sep 8, 2026first Sep 8, 17:01 UTC · Sep 8, 2026Advisory 2 sourcesCVE-2026-66036 CVE-2026-66038 CVE-2026-660391

Video compressor

Simon Willison built a browser-based video compressor using the WebAssembly FFmpeg build, generated by Claude Fable 5.1 in Claude Code for web.

Simon WillisonSep 7, 18:29 UTC · Sep 7, 2026AI tools & infra3 · 1 read

Show HN: VODForge – a free local desktop UI for YouTube video/playlist downloads

VODForge 0.1.8 is a free, MIT-licensed desktop app wrapping yt-dlp and FFmpeg for local YouTube video and playlist downloads.

Hacker News · securitySep 6, 20:07 UTC · Sep 6, 2026Other HN 38 points · 12 comments3 · 1 read

Related CVEs

by mentions

CVE-2026-11149783%9.2
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
published 8d agoGoogle BrotliKEVPoC ×25
CVE-2026-30754<1%8.8
Out-of-bounds write in FFmpeg RTP H.264/HEVC encoder (negative-size memcpy)
published Sep 8, 2026FFmpeg Project FFmpeg (libavformat RTP encoder for H.264/HEVC, libavformat/rtpenc_h264_hevc.c)PoC
CVE-2026-66039<1%8.7
FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt…
published Jul 24, 2026ffmpeg ffmpeg
CVE-2026-64831<1%8.7
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite…
published Jul 22, 2026ffmpeg ffmpeg
CVE-2026-64830<1%8.7
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap…
published Jul 22, 2026ffmpeg ffmpeg
CVE-2026-38349<1%7.5
Integer Overflow DoS in FFmpeg libswscale Image Scaling (hScale16To19_c)
published Aug 28, 2026FFmpeg Project FFmpeg (libswscale, libswscale/output.c)
CVE-2026-38344<1%7.5
NULL pointer dereference in FFmpeg libswscale allows DoS via crafted video files
published Aug 28, 2026FFmpeg Project FFmpeg (libswscale, /libswscale/slice.c)
CVE-2026-38348<1%7.5
Integer Overflow DoS in FFmpeg libswscale via Crafted Images
published Aug 28, 2026FFmpeg project FFmpeg (libswscale/utils.c)
CVE-2026-38346<1%7.5
Integer overflow in FFmpeg libswscale enables DoS via crafted video file
published Aug 28, 2026FFmpeg (libswscale component, libswscale/output.c)
CVE-2026-66038<1%7.1
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose…
published Jul 24, 2026ffmpeg ffmpeg

Appears with

.NETproduct · 4
Brotliproduct · 4
Apache Arrowproduct · 4
Googlevendor · 4
JFrogorganization · 3
Canonicalvendor · 3
Microsoftvendor · 3
ClickHouseproduct · 3
Node.jsproduct · 3
Envoy Proxyproduct · 2
Ubuntuproduct · 2
Bunproduct · 2
Istioproduct · 2
Tenableorganization · 2
Canonicalorganization · 2
Anthropicvendor · 1

Entities are extracted by the model from each article. First seen Sep 6, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.