BSD Portsffmpeg -- Out-of-bounds write
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159 reports: An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.
Affected versions
- ffmpeg < 8.1.2,1
- ffmpeg4 < 4.4.7
- ffmpeg6 < 6.1.6
By system
2 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | multimedia/ffmpeg | 6.1.2_8,1 | vulnerable since 2026-06-25 | |
| OpenBSD | graphics/ffmpeg | 9.0.2v1 | out of range, by version | |
| MidnightBSD | multimedia/ffmpeg | 8.0.1_3,1 | in range, by version | |
| FreeBSD | multimedia/ffmpeg | 9.0.2_2,1 | fixed | (72 days after) |
| DragonFly | multimedia/ffmpeg4 | 4.4.4_18 | vulnerable since 2026-06-25 | |
| NetBSD | multimedia/ffmpeg4 | 4.4.8nb3 | not listed | |
| MidnightBSD | multimedia/ffmpeg4 | 4.4.4_5 | in range, by version | |
| FreeBSD | multimedia/ffmpeg4 | 4.4.8_2 | fixed | (82 days after) |
| GhostBSD | multimedia/ffmpeg6 | 6.1.6_1 | fixed | |
| NetBSD | multimedia/ffmpeg6 | 6.1.6nb3 | not listed | |
| HardenedBSD | multimedia/ffmpeg6 | 6.1.6_1 | fixed |