CVE-2026-30999
Heap Buffer Overflow in FFmpeg v8.0.1 Causes DoS
Publication date: 2026-04-13
Last updated on: 2026-04-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ffmpeg | ffmpeg | to 8.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow located in the av_bprint_finalize() function of FFmpeg version 8.0.1. It occurs when the function processes crafted input that exceeds the allocated buffer size, leading to memory corruption.
An attacker can exploit this flaw by providing specially crafted input to FFmpeg, which triggers the overflow.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this heap buffer overflow vulnerability in FFmpeg v8.0.1 on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
The primary impact of this vulnerability is that it allows an attacker to cause a Denial of Service (DoS) condition. This means the affected FFmpeg application or service could crash or become unresponsive when processing malicious input.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update FFmpeg to a version that has addressed the heap buffer overflow issue in the av_bprint_finalize() function. Since the vulnerability affects FFmpeg version 8.0.1, upgrading to a later version, such as 8.1 or newer, is recommended.
You can download the latest FFmpeg source code or binaries from the official FFmpeg website or trusted package repositories.