FFmpeg vulnerabilities
- In CISA's KEV catalog
- 0 exploited vulnerabilities
- CVE records, last 3 years
- 83 since
Rank 185 of 420 vendors on this site - Critical or high
- 59% of 83 scored records; 0 not scored
Source: CISA KEV 2026.10.30, as of ; CVE List, as of . About the data.
- FFmpeg has 83 CVE records published between 3 Nov 2023 and 3 Nov 2026, ranking #185 of 420 vendors on this site by that count.
- Of the 83 with a CVSS score, 49 (59%) are rated critical or high; 0 (0% of all) have no CVSS score.
- None of the CVE records attributed to FFmpeg is listed in CISA's KEV catalog as of 3 Nov 2026.
CVE records per year, by severity
- Critical
- High
- Medium, low or none
- Not scored
* 2026 is counted through .
Show data as a table
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026* | 50 | 1 | 26 | 54% | 0% |
| 2025 | 9 | 0 | 5 | 55.6% | 0% |
| 2024 | 24 | 3 | 14 | 70.8% | 0% |
| 2023 | 0 | 0 | 0 | — | — |
| 2022 | 1 | 1 | 0 | 100% | 0% |
| 2021 | 0 | 0 | 0 | — | — |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 0 | 0 | 0 | — | — |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
"Critical or high" is the share of scored records; "Not scored" is the share of all records.
Source: CVE List, as of . About the data.
New critical FFmpeg vulnerabilities not in KEV
CVE records with a CVSS score of 9.0 or higher, published in the last 90 days, that CISA has not added to KEV. Newest first.
- CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader
Source: CVE List, as of ; FIRST EPSS, as of ; CISA KEV 2026.10.30, as of . About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. The highest-scoring FFmpeg records today, from 1%.
Source: FIRST EPSS, as of ; CVE List, as of ; CISA KEV 2026.10.30, as of . About the data.