ffmpeg
Version: 8.1.2Mirror of https://git.ffmpeg.org/ffmpeg.git
What is "ffmpeg"?
Mirror of https://git.ffmpeg.org/ffmpeg.git
How to use this package
Quick install
Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.
min add ffmpegDeclare as a task dependency in minimal.toml
Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.
[tasks.dev]
packages = ["ffmpeg"]Build-time vs runtime
Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.
min add --build ffmpeg
min add --runtime ffmpegDependencies (21)
| Name | Version | Kind |
|---|---|---|
| base | — | build |
| dav1d | 1.5.4 | runtime |
| fontconfig | 2.18.2 | runtime |
| freetype | 2.14.3 | runtime |
| fribidi | 1.0.16 | runtime |
| harfbuzz | 14.2.1 | runtime |
| libaom | 3.14.1 | runtime |
| libass | 0.17.5 | runtime |
| libfdk-aac | 2.0.3 | runtime |
| libopus | 1.6.1 | runtime |
| libsvtav1 | 4.2.0 | runtime |
| libvmaf | 3.2.0 | runtime |
| libvpx | 1.16.0 | runtime |
| libx264 | 0.165.3222 | runtime |
| libx265 | 4.2 | runtime |
| make | 4.4.1 | build |
| openssl | 3.6.3 | runtime |
| pkgconf | 3.0.4 | build |
| toolchain | — | build |
| xz | 5.8.3 | runtime |
| zlib | 1.3.2 | runtime |
Dependency changes
Loading diff…
Could not load the dependency diff for one of the selected versions. Try again.
No dependency changes
The two selected versions have identical direct dependencies.
| Name | Version | Kind |
|---|
No dependants
No other packages in the registry depend on this one.
- Lines:+2 / -2Deps:21Released:
- Lines:+3 / -1Deps:21Released:
- Lines:+25 / -16Deps:21(+3)Released:
- Lines:+1Deps:18Released:
- Lines:+16Deps:18(+4)Released:
- Lines:+15Deps:14(+5)Released:
- Lines:+1 / -1Deps:9Released:
- Lines:+5Deps:9Released:
- Lines:+6 / -1Deps:9Released:
- Lines:+2Deps:9(+1)Released:
- Lines:+68Deps:8(+8)Released:
Showing 11 advisories, 5 of which are transitive via ffmpeg's dependencies
No advisories match the current filters.
| Critical (0) | ||||||
| Status | IDs | Package | Severity | |||
|---|---|---|---|---|---|---|
| High (8) | ||||||
| Status | IDs | Package | Severity | |||
Under investigation | ffmpeg | High: 8.8 | ||||
SummaryFFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | ||||||
Under investigation | ffmpeg | High: 7.5 | ||||
SummaryFFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | ||||||
Under investigation | ffmpeg | High: 7.1 | ||||
SummaryFFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H | ||||||
Under investigation | ffmpeg | High: 8.8 | ||||
SummaryFFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | ||||||
Under investigation | ffmpeg | High: 8.8 | ||||
SummaryFFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | ||||||
Under investigation | ffmpeg | High: 8.8 | ||||
SummaryFFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer. Affected ranges8.1 – 8.1.2 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | ||||||
Under investigation | glibc | High: 7.3 | ||||
SummaryThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. Affected ranges2.42 – 2.44 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | ||||||
Under investigation | pcre2 | High | ||||
SummaryHeap-buffer-overflow in pcre2_compile_32 Affected ranges10.45 – 10.47 References | ||||||
| Medium (2) | ||||||
| Status | IDs | Package | Severity | |||
Under investigation | libpng | Medium: 5.4 | ||||
SummaryLIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body Affected ranges1.6.50 – 1.6.58 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L References
| ||||||
Under investigation | glibc | Medium: 6.5 | ||||
SummaryThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. Affected ranges2.42 – 2.44 CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | ||||||
| Low (0) | ||||||
| Status | IDs | Package | Severity | |||
| Unknown (1) | ||||||
| Status | IDs | Package | Severity | |||
Under investigation | pcre2 | Unknown | ||||
Summarypcre2_serialize_encode() information disclosure Affected ranges10.45 – 10.47 | ||||||
74 components
No components match your filter.
| Packages | Version |
|---|---|
| ffmpegROOT | 8.1.2 |
| acl | 2.4.0 |
| attr | 2.6.0 |
| autoconf | 2.73 |
| automake | 1.18.1 |
| bash | 5.3 |
| bash-bootstrap | 5.3 |
| binutils | 2.47 |
| bison | 3.8.2 |
| bzip2 | 1.0.8 |
| cmake | 4.4.0 |
| coreutils | 9.11 |
| curl | 8.21.0 |
| dav1d | 1.5.4 |
| diffutils | 3.12 |
| expat | 2.8.2 |
| file | 5.48 |
| findutils | 4.11.0 |
| flex | 2.6.4 |
| fontconfig | 2.18.2 |
| freetype | 2.14.3 |
| fribidi | 1.0.16 |
| gawk | 5.4.1 |
| gawk-bootstrap | 5.4.1 |
| gcc | 15.2.0 |
| gdbm | 1.26 |
| glib | 2.88.2 |
| glibc | 2.44 |
| gmp | 6.3.0 |
| gperf | 3.3 |
| grep | 3.12 |
| gzip | 1.14 |
| harfbuzz | 14.2.1 |
| libaom | 3.14.1 |
| libass | 0.17.5 |
| libcap | 2.78 |
| libfdk-aac | 2.0.3 |
| libffi | 3.7.1 |
| libidn2 | 2.3.8 |
| libopus | 1.6.1 |
| libpng | 1.6.58 |
| libpsl | 0.23.0 |
| libsvtav1 | 4.2.0 |
| libtool | 2.6.2 |
| libunistring | 1.4.2 |
| libuv | 1.52.1 |
| libvmaf | 3.2.0 |
| libvpx | 1.16.0 |
| libx264 | 0.165.3222 |
| libx265 | 4.2 |
| linux_headers | 6.12.43 |
| lz4 | 1.10.0 |
| m4 | 1.4.21 |
| make | 4.4.1 |
| meson | 1.11.2 |
| mpc | 1.4.1 |
| mpfr | 4.2.2 |
| nasm | 3.02 |
| ncurses | 6.6 |
| ninja | 1.13.2 |
| openssl | 3.6.3 |
| pcre2 | 10.47 |
| perl | 5.44.0 |
| pkgconf | 3.0.4 |
| python | 3.14.6 |
| readline | 8.3 |
| sed | 4.10 |
| setuptools | 83.0.0 |
| sqlite | 3.53.3 |
| tar | 1.35 |
| util-linux | 2.42.2 |
| xz | 5.8.3 |
| zlib | 1.3.2 |
| zstd | 1.5.7 |