FFmpeg: 2.8.22 → 9
FFmpeg · upgrade impact · Official site ↗
Fixed by upgrading to 9 iVulnerabilities that affect 2.8.22 but no longer affect 9 — the security gain from this upgrade, by exploited status then exploitation probability.
Exploited first, then by exploitation probability (EPSS).
CVE-2026-66040 HIGH EPSS 1% ✓ cleared in 9 CVE-2026-64834 HIGH EPSS 1% ✓ cleared in 9 CVE-2026-30754 HIGH EPSS 1% ✓ cleared in 9 CVE-2026-107695 MEDIUM EPSS 0% ✓ cleared in 9 CVE-2026-66039 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-64830 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-107697 MEDIUM EPSS 0% ✓ cleared in 9 CVE-2026-66036 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-107698 MEDIUM EPSS 0% ✓ cleared in 9 CVE-2026-66038 MEDIUM EPSS 0% ✓ cleared in 9 CVE-2026-64833 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-65703 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-52295 LOW EPSS 0% ✓ cleared in 9 CVE-2026-52296 LOW EPSS 0% ✓ cleared in 9 CVE-2026-52297 LOW EPSS 0% ✓ cleared in 9 CVE-2026-70628 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-70631 MEDIUM EPSS 0% ✓ cleared in 9 CVE-2026-65704 HIGH EPSS 0% ✓ cleared in 9 CVE-2026-96611 MEDIUM EPSS 0% ✓ cleared in 9Still open in 9 iKnown vulnerabilities that affect 9 too — upgrading to it does not clear these.
These affect 9 as well — a later release may be needed.
CVE-2026-107696 MEDIUM EPSS 0% → see advisory CVE-2026-107675 MEDIUM EPSS 0% → see advisory CVE-2026-107660 MEDIUM EPSS 0% → fixed in 9.0.2 CVE-2026-107676 LOW EPSS 0% → see advisory CVE-2026-107677 MEDIUM EPSS 0% → see advisory CVE-2026-107678 MEDIUM EPSS 0% → see advisory