CVE-2026-120210
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.
Risk Assessment
An attacker can gain information about the filesystem and potentially read or expose local files. The risk affects services processing untrusted IMF packages.
Recommendation
Upgrade FFmpeg beyond 9.0.2. Restrict processing of untrusted IMF packages and run the demuxer in an isolated environment.
Other vulnerabilities in FFmpeg
See all- CVE-2017-15672High
The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
- CVE-2017-14767High
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before version 3.3.4 mishandles empty sprop-parameter-sets values, allowing remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
- CVE-2017-14225High
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, leading to a NULL pointer dereference in the avcodec_string function in libavcodec/utils.c.
- CVE-2012-2805High
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
- CVE-2017-11719High
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg versions 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
- CVE-2017-11665High
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service via a crafted stream, leading to segmentation violation and application crash.
- CVE-2017-9996High
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9995High
In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-9993High
FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.
- CVE-2017-9992High
A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Original NVD description (English source)
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS