Skip to content
Multiple High-Risk Vulnerabilities Discovered in FFmpeg

Multiple High-Risk Vulnerabilities Discovered in FFmpeg

First seen 10 Nov 2026, 06:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 12:44 UTC
  • •Six critical vulnerabilities in FFmpeg disclosed on November 9, 2026.
  • •Affected versions include FFmpeg before 8.1.3 and 9.x before 9.0.2.
  • •Exploitation requires user interaction with crafted media files.

On November 9, 2026, six vulnerabilities in FFmpeg were disclosed, affecting versions before 8.1.3 and 9.x before 9.0.2. These include heap buffer overflows and out-of-bounds writes, which could lead to memory corruption and potential system compromise. The vulnerabilities (CVE-2026-125203, CVE-2026-125204, CVE-2026-125196, CVE-2026-125201, CVE-2026-125202, CVE-2026-125208, CVE-2026-125209) impact systems that process untrusted media, particularly in media conversion, streaming, and editing workflows. Attackers can exploit these flaws by supplying crafted media files, requiring user interaction to trigger the vulnerabilities. While no active exploitation has been confirmed, the risk remains high due to the potential for service disruption and data compromise. Immediate remediation is advised as patches are available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-11-09
CVE disclosures published
Six vulnerabilities in FFmpeg were disclosed, affecting versions before 8.1.3 and 9.x before 9.0.2.
Redpacketsecurity
2026-11-09
Patches released
FFmpeg released patches for the vulnerabilities, urging users to upgrade immediately.
Redpacketsecurity
2026-11-09
CVE-2026-125201 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125209 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125196 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125208 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125202 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125203 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-09
CVE-2026-125204 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (47)

Following this threat?

Track CVE-2026-125196 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 3

Common questions

Which versions of FFmpeg are affected?
FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are affected by these vulnerabilities.
What should I do to protect my systems?
Upgrade to the latest version of FFmpeg as soon as possible to mitigate these vulnerabilities.
Is there any active exploitation reported?
No active exploitation has been confirmed as of now, but the vulnerabilities pose a significant risk.