tag
Ffmpeg
Fireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337
Fireshare's public upload endpoint (/api/upload/public) accepts multipart form fields (file, filename, folder) that are passed largely unsanitized into a downstream ffmpeg invocation used to process the uploaded video. By embedding extra ffmpeg-style…
VLC Bundled FFmpeg VP9 Decoder Resolution-Change Heap Crash
VLC 3.0.23's bundled FFmpeg VP9 decoder tracks per-frame slice-thread progress in an entries array sized from the superblock row count (sbrows) of the current frame. A crafted two-frame VP9 IVF file — a 64x64 first frame followed by a 64x8192 second frame…
FFmpeg RASC Decoder DLTA Heap Out-of-Bounds Write
FFmpeg's RASC decoder (decodedlta() in libavcodec/rasc.c) tracks a row cursor and only checks whether it has reached the end of the current row after certain operations, rather than before. Several DLTA run types (4, 7, 12, 13) perform 32-bit reads/writes at…
FFmpeg MagicYUV Decoder Out-of-Bounds Write / RCE — PixelSmash (CVE-2026-8461)
CVE-2026-8461 (codename PixelSmash) is a High-severity out-of-bounds heap write in FFmpeg's MagicYUV decoder (libavcodec). Improper bounds validation during frame decoding allows a specially crafted video file with an odd slice height to trigger a heap buffer…