Live › vulnerability › CVE-2026-120210
FFmpeg's IMF demuxer trusts file paths listed in an ASSETMAP without checking them, so a crafted package can point at files outside its folder. An attacker can read local MXF files, probe whether files exist and how large they are, or make the server issue requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Teams that run FFmpeg and feed it IMF packages from sources they do not fully trust, such as media ingest pipelines or services that transcode uploads. Systems that only process their own media or never handle IMF packages are unlikely to be exposed.
No product ranges from the sources yet.
ffmpeg -version; affected releases are 5.0 through 9.0.2.9.0.2 and earlier in the range 5.0 through 9.0.2 are affected; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-120210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.