Cloudanix VulnDB

CVE-2026-120210

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Oct 31, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A video processing program can be tricked into reading files outside its intended area when it opens a specially made video package, which could let someone peek at other files on the system.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits path traversal in the IMF demuxer by failing to sanitize ASSETMAP Path elements, allowing crafted packages to reference files outside the package directory using '..' sequences or absolute paths to read local MXF files, probe existence and size, or initiate server-side requests.

Why it matters to the business

Organizations using FFmpeg for media workflows face potential unauthorized file access and information disclosure when processing untrusted IMF packages, increasing risk of data leakage in content production or distribution pipelines.

How an attack unfolds

An attacker creates a malicious IMF package embedding traversal or absolute paths in the ASSETMAP XML, supplies it to a target FFmpeg instance, and triggers demuxing to access or probe arbitrary local MXF files or generate outbound requests.

How to fix it

Upgrade FFmpeg to a version containing path validation fixes for the IMF demuxer; refuse to process IMF packages from untrusted sources; apply least-privilege file access controls around media processing services.

How to confirm the fix worked

Test remediation by feeding a crafted IMF package containing '..' and absolute paths into the demuxer and confirm that only package-contained files are accessed with no external reads or probes possible.

Typical attack path

  1. Craft IMF package containing malicious ASSETMAP Path elements with traversal or absolute paths
  2. Deliver the package to a system running vulnerable FFmpeg
  3. Trigger IMF demuxing via command-line, library call, or automated workflow
  4. Observe successful file reads, existence probes, or side-channel responses

How to detect it

Inspect FFmpeg process logs, error output, and system file-access audit trails for unexpected reads of MXF files or IMF-related paths outside expected working directories.

What your security team should do

  • Prioritize patching FFmpeg once fixed versions are released given the public disclosure
  • Block or sandbox processing of external IMF packages until validated
  • Review and tighten file-system permissions for any service invoking FFmpeg IMF demuxing

The record

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities