OESA-2025-1771

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A heap-use-after-free in the mpegmuxwrite_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.(CVE-2020-21697)

Buffer Overflow vulnerability in FFmpeg 4.2 at convolutiony10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.(CVE-2020-22019)

Buffer Overflow vulnerability in FFmpeg 4.2 in the builddiffmap function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.(CVE-2020-22020)

Buffer Overflow vulnerability in FFmpeg 4.2 at filteredges function in libavfilter/vfyadif.c, which could let a remote malicious user cause a Denial of Service.(CVE-2020-22021)

Buffer Overflow vulnerability exists in FFmpeg 4.2 in the configinput function at libavfilter/aftremolo.c, which could let a remote malicious user cause a Denial of Service.(CVE-2020-22026)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodecalloccontext3 at options.c.(CVE-2020-22037)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ffv4l2m2mcreatecontext function in v4l2_m2m.c.(CVE-2020-22038)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inaviaddientry function.(CVE-2020-22039)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifoalloccommon function in libavutil/fifo.c.(CVE-2020-22043)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the urlopendynbufinternal function in libavformat/aviobuf.c.(CVE-2020-22044)

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filterframe function in vftile.c.(CVE-2020-22051)

Integer Overflow vulnerability in function filter16roberts in libavfilter/vfconvolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.(CVE-2021-38090)

A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file.(CVE-2025-22919)

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.(CVE-2025-22921)