Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

CVE-2026-40962 — MEDIUM severity vulnerability | Release Alert

ChocolateyFFmpeg is the leading multimedia framework, able to decode, encode, transcode, mux, demux, stream, filter and play pretty much anything that humans and machines have created. It supports the most obscure ancient formats up to the cutting edge. No matter if they were designed by some standards committee, the community or a corporation. It is also highly portable: FFmpeg compiles, runs, and passes our testing infrastructure FATE across Linux, Mac OS X, Microsoft Windows, the BSDs, Solaris, etc. under a wide variety of build environments, machine architectures, and configurations. The FFmpeg project tries to provide the best technically possible solution for developers of applications and end users alike. To achieve this we combine the best free software options available. We slightly favor our own code to keep the dependencies on other libs low and to maximize code sharing between parts of FFmpeg. Wherever the question of "best" cannot be answered we support both options so the end user can choose. Security is a high priority and code review is always done with security in mind. Though due to the very large amounts of code touching untrusted data security issues are unavoidable and thus we provide as quick as possible updates to our last stable releases when new security issues are found. ## Notes * This package is for the stable static essentials ffmpeg version. For a list of libraries included, go to https://www.gyan.dev/ffmpeg/builds/#libraries note that the list of libraries at the URL above will give those for the most recent version and may differ slightly from this package version * With version 4.4 the format of the version-number changed up until the next two releases it is expected that the flag `--version` is broken * **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**

< 8.1NVD

Security Advisories

CVE-2026-40962

Description

More on this CVE