Path Traversal Vulnerability in FFmpeg Product by FFmpeg

CVE-2026-120210

What is CVE-2026-120210?

FFmpeg versions 5.0 through 9.0.2 are susceptible to a path traversal vulnerability in the IMF demuxer. This issue allows attackers to exploit unvalidated ASSETMAP Path elements, enabling them to access files outside the intended package. By crafting a malicious IMF package containing '..' sequences or absolute paths, an attacker could manipulate the demuxer to read local MXF files or even probe for file existence and sizes, potentially leading to server-side requests that could compromise the system's integrity.

References