Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
FFmpeg CVE-2026-120247
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pi
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
FFmpeg CVE-2026-120246
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
FFmpeg CVE-2026-120245
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
FFmpeg CVE-2026-120244
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated R
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
FFmpeg CVE-2026-120243
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
FFmpeg CVE-2026-120210
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSE
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
FFmpeg ffmpeg-2026-10
FFmpeg Security Releases - October 2026
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit