FFMPEG v8.1.1 vulnerabilities

Open

#1,272 opened on Sep 2, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 45/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Domain: security

Research direction

Start by reviewing references #1258, #1248, #1255, and #1261, then locate the packaging or build entry point that produces the listed shared libraries. Confirm how the shipped ffmpeg version is selected and verify that the resulting packages no longer include v8.1.1 or the five listed CVEs, with the update to v9 reflected in the built artifacts.

Written by the indexing model from the issue text.

Description

The following vulnerabilities have been identified in the ffmpeg binaries shipped with version v5.0.0.93 of this package.

NAME	SEVERITY	VULNERABILITY	INSTALLED	FIXED IN
ffmpeg	High	CVE-2026-70632	v8.1.1	v9
ffmpeg	High	CVE-2026-70628	v8.1.1	v9
ffmpeg	Medium	CVE-2026-70631	v8.1.1	v9
ffmpeg	Medium	CVE-2026-70629	v8.1.1	v9
ffmpeg	Medium	CVE-2026-70630	v8.1.1	v9

Files

libavcodec-c4204469.so.62.28.101
libavformat-4762a711.so.62.12.101
libavutil-befbbc48.so.60.26.101
libswresample-2dfded3b.so.6.3.101

References

#1258
#1248
#1255
#1261

Dominant language: Python
Stars: 5.4k
Forks: 1k
Avg merge: 22h 17m
Merged PRs (30d): 3

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

slack-gif-creator: validate_gif() multiplies the last frame's duration by the frame count, so reported duration/fps are wrong (1.0s GIF reported as 1.8s) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

anthropics/skills#1811 · 1 comment · Opened Sep 23, 2026
App fails to start with gradio 6 (allowed by `gradio>=5.49.1`) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

speaches-ai/speaches#678 · Opened Sep 23, 2026
ModuleNotFoundError: No module named 'mcp.server.fastmcp'. Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

datalayer/mcp-compose#42 · Opened Sep 23, 2026
import spacy fails with ModuleNotFoundError: No module named 'click' Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

conda-forge/spacy-feedstock#177 · Opened Sep 23, 2026
humaneval: extract_function_body corrupts a fenced body-only reply, so the same correct code scores INCORRECT fenced and CORRECT unfenced Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

UKGovernmentBEIS/inspect_evals#2523 · Opened Sep 23, 2026

More Python issues