Port details

multimedia/ffmpeg9.0.2_2,1

Realtime audio/video encoder/converter and streaming server

Maintainer: multimedia@FreeBSD.org
Packages: ffmpeg 9.0.2_2,1, ffmpeg-nox11 9.0.2_2,1
Upstream: up to date
CPE: ffmpeg:ffmpeg from the port
WWW: https://ffmpeg.org/
Links: cgit · VuXML

Unaddressed (7) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 2025.01.13 would fix 2 of 7 unaddressed CVEs, according to the CVE records.

CVE-2026-107696	7.1	2026-10-08	FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attac…
CVE-2025-25468	6.5	2025-02-18	FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.
CVE-2025-25469	6.5	2025-02-18	FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.
CVE-2026-107675	6.0	2026-10-08	FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP s…
CVE-2026-107677	5.7	2026-10-08	FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTempla…
CVE-2026-107678	5.7	2026-10-08	FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInit…
CVE-2026-107676	4.8	2026-10-08	FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when t…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (21)

Show 21 fixed

VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).

CVE-2026-96611	6.9	2026-09-23	FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signe…
CVE-2026-107660	6.3	2026-10-08	FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname check…
CVE-2026-52296	2.9	2026-09-13	FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
CVE-2026-52297	2.9	2026-09-13	FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.
CVE-2026-52295	2.9	2026-09-01	FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.

ffmpeg -- Out-of-bounds writeentered 2026-06-25

CVE-2026-8461

ffmpeg -- multiple vulnerabilitiesentered 2023-04-07

CVE-2022-3109, CVE-2022-3341, CVE-2022-3964

ffmpeg -- multiple vulnerabilitiesentered 2018-07-27

CVE-2017-15186, CVE-2017-15672, CVE-2017-16840, CVE-2017-17081, CVE-2018-6392

FFmpeg -- multiple vulnerabilitiesentered 2017-10-12

CVE-2017-14054, CVE-2017-14055, CVE-2017-14056, CVE-2017-14057, CVE-2017-14058, CVE-2017-14059, CVE-2017-14169, CVE-2017-14170, CVE-2017-14171, CVE-2017-14222, CVE-2017-14223, CVE-2017-14225, CVE-2017-14767

ffmpeg -- heap overflow in lavf/mov.centered 2017-02-12

CVE-2017-5024, CVE-2017-5025

ffmpeg -- remote denial of service in JPEG2000 decoderentered 2016-02-06

CVE-2016-2213

ffmpeg -- remote attacker can access local filesentered 2016-01-17

CVE-2016-1897, CVE-2016-1898

ffmpeg -- multiple vulnerabilitiesentered 2015-12-28

CVE-2015-8662, CVE-2015-8663

ffmpeg -- multiple vulnerabilitiesentered 2015-12-02

CVE-2015-6761, CVE-2015-8216, CVE-2015-8217, CVE-2015-8218, CVE-2015-8219, CVE-2015-8363, CVE-2015-8364, CVE-2015-8365

ffmpeg -- multiple vulnerabilitiesentered 2015-09-20

CVE-2015-6818, CVE-2015-6819, CVE-2015-6820, CVE-2015-6821, CVE-2015-6822, CVE-2015-6823, CVE-2015-6824, CVE-2015-6825, CVE-2015-6826

ffmpeg -- out-of-bounds array accessentered 2015-09-01

CVE-2015-3395

ffmpeg -- use-after-freeentered 2015-09-01

CVE-2015-3417

ffmpeg -- multiple vulnerabilitiesentered 2015-06-02

CVE-2012-5150, CVE-2014-4609, CVE-2014-8541, CVE-2014-8542, CVE-2014-8543, CVE-2014-8545, CVE-2014-8547, CVE-2014-8548, CVE-2014-9316, CVE-2014-9317, CVE-2014-9603, CVE-2015-1872

ffmpeg -- multiple vulnerabilitiesentered 2012-01-14

CVE-2011-4351, CVE-2011-4352, CVE-2011-4353, CVE-2011-4364, CVE-2011-4579

ffmpeg -- 4xm processing memory corruption vulnerabilityentered 2009-03-16

CVE-2009-0385

ffmpeg -- libavcodec buffer overflow vulnerabilityentered 2005-12-07

no CVE referenced

Commits (664)

2026-10-10 15:01Gleb Popov (arrowd) · 9.0.2_2,1

*: Bump PORTREVISION on multimedia/x265 consumers

PR:		299194

e8660dbf74

2026-10-03 21:13Gleb Popov (arrowd) · 9.0.2_1,1

*: Bump PORTREVISION on multimedia/x265 consumers

PR:		298481

d98c0147b3

2026-09-28 20:57Daniel Engberg (diizzy) · 9.0.2,1

multimedia/ffmpeg: Update to 9.0.2

Changelog:
https://code.ffmpeg.org/FFmpeg/FFmpeg/src/tag/n9.0.2/Changelog

PR:		298668
Reviewed by:	makc
Exp-run by:	antoine

ff5c3b6e1d

2026-09-07 22:54Max Brazhnikov (makc) · 9.0.1,1

multimedia/ffmpeg: Fix plist

eb1adb5010

2026-09-05 16:16Daniel Engberg (diizzy) · 9.0.1,1

multimedia/ffmpeg: Update to 9.0.1

Support for (lib)celt, (lib)glslang and (lib)shaderc is removed upstream
Remove support for (lib)lensfun as it doesn't work with the old release
we have in tree

Changelog:
https://code.ffmpeg.org/FFmpeg/FFmpeg/src/tag/n9.0.1/Changelog

PR:		297355
Exp-run by:	antoine

e07612e18d

2026-08-25 16:39Vladimir Druzenko (vvd) · 8.1.2_3,1

*/*: Bump after soname changed in update audio/codec2

in 6621902b7ed5b3b2480461d0400baf8fb5fe662a

Approved by:	blanket
Sponsored by:	UNIS Labs

c7af4fa998

2026-08-17 03:57Hiroki Tagato (tagattie) · 8.1.2_2,1

multimedia:{ffmpeg,handbrake}: Switch dependency from onevpl to libvpl

onevpl has been superceded by libvpl upstream. So switch dependencies
of dependent ports.

PR:		293561
Reported by:	Yuichiro NAITO <naito.yuichiro@gmail.com>
Approved by:	portmgr (blanket; switch deprecated dependencies)

eba41bee20

2026-08-11 07:28Daniel Engberg (diizzy) · 8.1.2_2,1

*/*: Bump consumers of multimedia/libx264

Reported by:	Kevin Oberman <rkoberman@gmail.com>

388f5973b7

2026-07-04 02:32Jan Beich (jbeich) · 8.1.2_1,1

graphics/libjxl: update to 0.12

Changes:	https://github.com/libjxl/libjxl/releases/tag/v0.12.0
Reported by:	GitHub (watch releases)

fc57321249

2026-06-19 21:22Daniel Engberg (diizzy) · 8.1.2,1

multimedia/ffmpeg: Update to 8.1.2

Changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n8.1.2

0edcfc3bb7

2026-05-11 22:26Daniel Engberg (diizzy) · 8.1.1,1

multimedia/ffmpeg: Update to 8.1.1

Changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n8.1.1

PR:		295041
Exp-run by:	antoine

1a44fe040f

2026-03-29 21:47Daniel Engberg (diizzy) · 8.1,1

multimedia/ffmpeg: Update to 8.1

Changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n8.1

PR:		293872
Reviewed by:	makc
Exp-run by:	antoine

11391ea853

2026-02-12 01:45Jan Beich (jbeich) · 8.0.1_5,1

graphics/libplacebo: update to 7.360.0

Changes:	https://code.videolan.org/videolan/libplacebo/-/tags/v7.360.0
Reported by:	GitHub (watch releases)

1697360b77

2026-02-03 06:13Po-Chuan Hsieh (sunpoet) · 8.0.1_4,1

graphics/lcms2: Bump PORTREVISION of dependent ports for shlib change

PR:		292881
Reported by:	Petr Lampa <lampa@fit.vutbr.cz>

2adc4bef7d

2026-01-29 01:57Jan Beich (jbeich) · 8.0.1_3,1

multimedia/libvpx: update 1.16.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.15.2..v1.16.0
Reported by:	Repology

939d8775e7

2026-01-24 23:16Jan Beich (jbeich) · 8.0.1_2,1

multimedia/svt-av1: update to 4.0.0

Changes:	https://gitlab.com/AOMediaCodec/SVT-AV1/-/releases/v4.0.0
Reported by:	GitLab (notify releases)

4b390bd6db

2025-12-26 10:50Jason E. Hale (jhale) · 8.0.1_1,1

*/*: Chase multimedia/libtheora shlib bump

e14a177aa3

2025-12-24 16:12Baptiste Daroussin (bapt) · 8.0.1,1

multimedia/ffmpeg: add a configure patch

When pushing ffmpeg 8.0.1 I forgot the to git add the configure patch
to fix detection of support for symbol versionning

PR:	 291868

d64ae40ff3

2025-12-24 09:55Baptiste Daroussin (bapt) · 8.0.1,1

multimedia/ffmpeg: update to 8.0.1

- fix XCB option [1]
- add a nox11 flavor [2]
- detect breakage in symbol versionning detection [3]
- incorporate a chromium patch to readd av_stream_get_first_dts()
  necessary to unbundle ffmpeg in chromium distributions like
  qt*-webengine. as of today chromium devs has not found a way to
  avoid using this function so they keep readding this function in
  their bundled version of ffmpeg.

PR: 	290246 [1]
PR: 	278705 [2]
PR:	291868 [3]

c204aaf791

2025-11-22 21:52Robert Clausecker (fuz) · 6.1.2_17,1

*/*: bump PORTREVISION following lib/libx265.so soname change

Reported by:	vvd

e6242cd11e

2025-10-01 11:00Hiroki Tagato (tagattie) · 6.1.2_16,1

multimedia/ffmpeg: fix build with glslang >= 16.0 when GLSLANG option is ON

No port revision bump since GLSLANG is not a default option.

PR:		289912
Reported by:	Frank Reisert <bugs@rufus.in-berlin.de>
Tested by:	Frank Reisert <bugs@rufus.in-berlin.de>
Approved by:	portmgr (blanket; build fix)
Obtained from:	https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/f1e9032a2000b8b885cffd6fed8eacd47b37673f

575ab79a85

2025-08-06 05:01Koichiro Iwao (meta) · 6.1.2_16,1

*/*: Bump multimedia/openh264 consumers after dc94e01

net/freerdp{,3} have been already bumped in e447cd0, so not being bumped
again.

Bumped by the following one-liner:

  $ git grep -l libopenh264 | \
      grep '^.*/.*/Makefile$'| \
      xargs -t -n1 portedit bump-revision -i

Approved by:	portmgr (blanket)

4a75e65503

2025-07-03 02:42Jan Beich (jbeich) · 6.1.2_15,1

graphics/glslang: update to 15.4.0

Changes:	https://github.com/KhronosGroup/glslang/releases/tag/15.4.0
Reported by:	GitHub (watch releases)

79c1483eda

2025-06-30 11:04Baptiste Daroussin (bapt) · 6.1.2_14,1

libxml2: chase libxml soversion bump

3068854dd0

2025-05-26 21:41Jan Beich (jbeich) · 6.1.2_13,1

multimedia/rav1e: update to 0.8.0

Changes:	https://github.com/xiph/rav1e/releases/tag/v0.8.0
Reported by:	GitHub (watch releases)

64cbb40909

2025-05-21 23:18Jan Beich (jbeich) · 6.1.2_12,1

graphics/libplacebo: update to 7.351.0

Changes:	https://code.videolan.org/videolan/libplacebo/-/tags/v7.351.0
Reported by:	GitHub (watch releases)

e0380d01e0

2025-04-26 02:33Jan Beich (jbeich) · 6.1.2_11,1

graphics/glslang: update to 15.3.0

Changes:	https://github.com/KhronosGroup/glslang/releases/tag/15.3.0
Reported by:	GitHub (watch releases)

808f64e9a3

2025-04-24 02:55Jan Beich (jbeich) · 6.1.2_10,1

graphics/spirv-tools: update to 2025.2.r1

Changes:	https://github.com/KhronosGroup/SPIRV-Tools/compare/v2025.1...v2025.2.rc1
Reported by:	Repology

00045e68e1

2025-04-10 19:34Jan Beich (jbeich) · 6.1.2_9,1

multimedia/libvpx: update 1.15.1

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.15.0..v1.15.1
Reported by:	portscout

64f3a6bf7e

2025-02-28 01:27Jan Beich (jbeich) · 6.1.2_8,1

multimedia/svt-av1: update to 3.0.0

Changes:	https://gitlab.com/AOMediaCodec/SVT-AV1/-/releases/v3.0.0
Reported by:	/r/AV1

9253060fd1

2025-01-02 17:31Tijl Coosemans (tijl) · 6.1.2_7,1

security/mbedtls: Move to security/mbedtls2

The port has expired but isn't removed yet because there are still too
many consumers.  Rename it because the name "security/mbedtls" makes it
look like it's the default version.

PR:		283792

5e762dcd49

2024-11-23 09:31Gleb Popov (arrowd) · 6.1.2_6,1

*: Bump PORTREVISIONs of Pulseaudio consumers

Sponsored by:	Future Crew, LLC

5505c50fcc

2024-11-02 02:01Jan Beich (jbeich) · 6.1.2_5,1

multimedia/libvpx: update 1.15.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.14.1..v1.15.0
Reported by:	Repology

888cea7dee

2024-10-06 13:49Robert Clausecker (fuz) · 6.1.2_4,1

*/*: bump port revisions of dependents following x265 updates

PR:		281680

90e15809d9

2024-09-27 20:52Jan Beich (jbeich) · 6.1.2_3,1

multimedia/ffmpeg: enable LTO by default on aarch64 and amd64

6% faster decode at least with HEVC and MPEG-2 (HDTV) + -vf bwdif

PR:		271798
Inspired by:	Apline, Arch, Chimera, CRUX, Fedora, OpenMandriva, Solus
Reviewed by:	olivier

4042f2b495

2024-09-23 09:13Jason E. Hale (jhale) · 6.1.2_2,1

*/*: Chase multimedia/libdc1394 shlib bump

d5ee8e4a8d

2024-09-14 00:08Jan Beich (jbeich) · 6.1.2_1,1

graphics/libjxl: update to 0.11.0

Changes:	https://github.com/libjxl/libjxl/releases/tag/v0.11.0
Reported by:	GitHub (watch releases)

402b658a02

2024-08-13 15:53Jan Beich (jbeich) · 6.1.2,1

multimedia/ffmpeg: update to 6.1.2

Changes:	https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/n6.1.2:/Changelog
Reported by:	Repology, portscout

25b37a7bcd

2024-07-03 00:19Jan Beich (jbeich) · 6.1.1_6,1

graphics/libplacebo: update to 7.349.0

Changes:	https://code.videolan.org/videolan/libplacebo/-/tags/v7.349.0
Reported by:	GitHub (watch releases)

13d83153bd

2024-05-01 12:08Daniel Engberg (diizzy) · 6.1.1_5,1

multimedia/ffmpeg*: Remove support for librtmp

Remove invalid option as support for librtmp was removed in
8d01b5458f4660725fcaf562cdbb073debc9b751

c5b1e3db10

2024-03-14 12:34Jan Beich (jbeich) · 6.1.1_5,1

multimedia/svt-av1: update to 2.0.0

Changes:	https://gitlab.com/AOMediaCodec/SVT-AV1/-/releases/v2.0.0
Reported by:	Repology, /r/AV1

0f3f19c00c

2024-02-22 20:33Jan Beich (jbeich) · 6.1.1_4,1

graphics/libjxl: force rebuild consumers after 4c1f4b3f46bc

$ ffmpeg
ld-elf.so.1: Shared object "libjxl.so.0.9" not found, required by "libavcodec.so.60"

Reported by:	vvd

e033cbdc91

2024-02-02 14:32Jan Beich (jbeich) · 6.1.1_3,1

graphics/vulkan-headers: update to 1.3.277

Force rebuild vulkan-loader to make sure vulkaninfo shows the new version.

Changes:	https://github.com/KhronosGroup/Vulkan-Headers/compare/v1.3.276...v1.3.277
See also:	https://www.khronos.org/blog/khronos-releases-vulkan-video-av1-decode-extension-vulkan-sdk-now-supports-h.264-h.265-encode
Reported by:	Repology, portscout

746d696b4a

2024-02-01 05:13Jan Beich (jbeich) · 6.1.1_2,1

multimedia/ffmpeg: swap _IMPLIES for VULKAN and GLSLANG

- Vulkan Video doesn't need either glslang or shaderc
- For consistency with graphics/libplacebo

PR:		276469
Suggested by:	vvd

4fae7617b7

2024-01-28 00:07Muhammad Moinur Rahman (bofh) · 6.1.1_2,1

multimedia/ffmpeg: Moved man to share/man

Approved by:    portmgr (blanket)

e3cfad06c0

2024-01-20 01:41Jan Beich (jbeich) · 6.1.1_1,1

multimedia/libvpx: update 1.14.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.13.1..v1.14.0
Reported by:	portscout

589aaaeb09

2024-01-04 14:01Jan Beich (jbeich) · 6.1.1,1

graphics/glslang: update to 14.0.0

Changes:	https://github.com/KhronosGroup/glslang/releases/tag/13.0.0
Reported by:	GitHub (watch releases)

d35ea7b74f

2024-01-01 05:36Jan Beich (jbeich) · 6.1.1,1

multimedia/ffmpeg: update to 6.1.1

Changes:	https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/n6.1.1:/Changelog
Reported by:	Repology, portscout

a5307f7c55

2023-12-31 00:39Jan Beich (jbeich) · 6.1_5,1

multimedia/rav1e: update to 0.7.0

Changes:	https://github.com/xiph/rav1e/releases/tag/v0.7.0
Reported by:	GitHub (watch releases)

d513c9a9ea

2023-12-22 21:01Jan Beich (jbeich) · 6.1_4,1

graphics/libjxl: update to 0.9.0

Changes:	https://github.com/libjxl/libjxl/releases/tag/v0.9.0
Reported by:	GitHub (watch releases)

11b08d733b

lang/php82 +57 related 11 CVEs · 9.2 fixed 8.2.35 VuXML	Oct 21
lang/php83 +57 related 11 CVEs · 9.2 fixed 8.3.36 VuXML	Oct 21
lang/php84 +55 related 12 CVEs · 9.2 fixed 8.4.27 VuXML	Oct 21
lang/php85 +54 related 12 CVEs · 9.2 fixed 8.5.12 VuXML	Oct 21
lang/php86 2 open · 9.2 → 8.6.0.r4 VuXML	Oct 21
www/linux-chrome 819 open · 9.8	Oct 20
graphics/py-pillow 2 open · 8.2	Oct 19
textproc/antiword 2 open · 6.8	Oct 16
databases/mariadb1011-client +1 related 14 CVEs · 9.9 fixed 10.11.19	Oct 16
databases/mariadb114-client +1 related 14 CVEs · 9.9 fixed 11.4.13	Oct 16
databases/mariadb118-client +1 related 14 CVEs · 9.9 fixed 11.8.9	Oct 16
databases/mariadb123-client +1 related 15 CVEs · 9.9 fixed 12.3.3	Oct 16
net/freerdp 53 open · 9.4	Oct 16
net/freerdp3 33 CVEs · 8.7 fixed 3.32.2	Oct 16
astro/cfitsio 2 open · 6.9	Oct 15

node	Oct 24
node22	Oct 24
node24	Oct 24
node26	Oct 24
traefik	Oct 24
ca_root_nss	Oct 23
gitlab-ce	Oct 23
gitlab-ee	Oct 23
mailpit	Oct 23
vifm	Oct 23
brotli	Oct 22
chromium	Oct 22
jackson-core	Oct 22
jackson-databind	Oct 22
jackson-databind	Oct 22
keycloak	Oct 22
ungoogled-chromium	Oct 22
FreeBSD	Oct 21
p5-DBI	Oct 21
php82	Oct 21
php83	Oct 21
php84	Oct 21
php85	Oct 21
php86	Oct 21
powerdns-recursor	Oct 21