CVE-2026-30998: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-30998 is an improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 that allows attackers to cause a Denial of Service (DoS) by supplying a crafted input file. The vulnerability was published on April 13, 2026, and affects FFmpeg versions up to and including 8.0.1. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and stems from improper resource deallocation and closure in the zmqsend.c utility tool within FFmpeg. Reviewing the source code, the zmqsend tool reads an input file into a buffer using av_bprint, creates a ZMQ socket, and sends the content; however, under certain error or crafted-input conditions, resources such as file handles, ZMQ sockets, or memory buffers may not be properly released, leading to resource exhaustion. An attacker can exploit this by supplying a specially crafted input file to the zmqsend utility, triggering the resource leak and causing the process or service to become unavailable (GitHub Source, GitHub Advisory).

Successful exploitation results in a Denial of Service condition, causing FFmpeg's zmqsend component to become unavailable. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized modification. An unauthenticated remote attacker can trigger the crash by submitting a crafted input file, potentially disrupting media processing pipelines or services that rely on FFmpeg's ZMQ messaging functionality (Feedly, GitHub Advisory).

No confirmed, functional exploit is publicly available for CVE-2026-30998. A Notion page referenced as a potential exploit source was found to contain no actual exploit code, steps, or technical details (Feedly). There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038–0.071%, placing it in a low exploitation probability percentile (GitHub Advisory).

Users should update FFmpeg to a version newer than 8.0.1 once a patched release is available. As interim mitigations, restrict network access to systems running FFmpeg and avoid processing untrusted or crafted media/input files with the zmqsend utility. Implementing input validation and sanitization for media files before they are passed to FFmpeg components is also recommended (Feedly, GitHub Advisory). Detection coverage is available via Nessus plugins 306746 and 307356 (Feedly).

The vulnerability received limited community attention, with brief mentions on aggregator sites and the Yocto Project security mailing list tracking it as part of routine CVE metrics reporting (Yocto Security List). No significant vendor statements, notable researcher commentary, or major media coverage have been identified beyond standard vulnerability database entries.