Ffmpeg — PoC Archive

Fireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337

Sun, 05 Jul 2026 00:00:00 +0000

Info severity — web · CVE-2026-54337 (see [GHSA-hmh2-6g84-q8jx](https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-hmh2-6g84-q8jx)). Status: PoC. Affects: Fireshare (self-hosted video sharing app), <= 1.16.3. Tags: fireshare, unauthenticated, arbitrary-file-write, argument-injection, ffmpeg, file-upload, cwe-73, docker.

VLC Bundled FFmpeg VP9 Decoder Resolution-Change Heap Crash

Fri, 03 Jul 2026 00:00:00 +0000

Medium severity — binary · None assigned as of 2026-07-03. Status: Incomplete PoC. Affects: VLC media player, bundled FFmpeg VP9 decoder (plugins/codec/libavcodec_plugin.dll). Tags: vlc, ffmpeg, vp9, ivf, heap-overflow, media-parsing, crash, windows, decoder.

FFmpeg RASC Decoder DLTA Heap Out-of-Bounds Write

Fri, 03 Jul 2026 00:00:00 +0000

Critical severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: FFmpeg, libavcodec RASC decoder (AV_CODEC_ID_RASC). Tags: ffmpeg, libavcodec, heap-overflow, rasc, oob-write, media-parsing, codec, memory-corruption.

FFmpeg MagicYUV Decoder Out-of-Bounds Write / RCE — PixelSmash (CVE-2026-8461)

Tue, 30 Jun 2026 00:00:00 +0000

High severity (CVSS 8.8) — binary · CVE-2026-8461. Status: PoC. Affects: FFmpeg libavcodec — MagicYUV video decoder. Tags: RCE, OOB-write, heap-corruption, FFmpeg, MagicYUV, media, video, PixelSmash, libavcodec, Python, High.