Is CVE-2026-120210 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120210?

CVE-2026-120210 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-120210

Description

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.