Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

ffmpeg.org Updated

Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.

Top reward
$1,500
Sorona
Programs
2
1 pays cash
Targets in scope
10
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

FFmpeg

Sorona · Pays the most of the 2 programs: up to $1,500.
  • FFmpeg

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • FFmpeg

    Self-hosted · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets across all 2 programs, each listed once with the programs that cover it. 5 excluded.

  • ffmpeg.org

    Domains

    Covered by Self-hosted, Sorona

  • libavcodec in full: the H.264, HEVC, VP9 and AV1 bitstream parsers, the encoders, and the legacy codecs such as Cinepak, Indeo and RealVideo that are still compiled in

    Products and areas

    Covered by Sorona

  • libavfilter filter-graph construction and buffer handling across the whole filter set

    Products and areas

    Covered by Sorona

  • libavformat in full: every demuxer and muxer, MOV and MP4, Matroska, ASF, FLV, HLS and MPEG-TS among them, plus the long tail of formats nobody names

    Products and areas

    Covered by Sorona

  • libavutil and libavdevice, the shared allocation, arithmetic and capture-device layers that everything above is built on

    Products and areas

    Covered by Sorona

  • libswscale and libswresample colour-space, scaling and sample-rate conversion

    Products and areas

    Covered by Sorona

  • Protocol and I/O handling in libavformat/protocols: HTTP, RTSP and RTMP, and the SSRF-adjacent concat and subfile handlers

    Products and areas

    Covered by Sorona

  • Reports go to [email protected] and cover FFmpeg's own tree in full, every library and every tool the project ships. Only code FFmpeg links against but does not vendor sits outside

    Products and areas

    Covered by Sorona

  • Secure-by-design work across the parser layer: replacing C-style buffers, integer-arithmetic cleanup in stride and dimension maths, and Rust interop scaffolding

    Products and areas

    Covered by Sorona

  • The ffmpeg, ffprobe and ffplay command-line tools, their option parsing and the input they accept from a caller

    Products and areas

    Covered by Sorona

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A vulnerability report with no merged patch behind it, where the Google money is concerned: that rail pays for the fix rather than the finding

    Sorona

  • Anything the FFmpeg maintainers decline to merge, since Google will not override a maintainer's decision

    Sorona

  • One-liner patches for non-exploitable crashes and for denial of service that amounts to resource exhaustion

    Sorona

  • Patches older than twelve months or younger than one month at submission

    Sorona

  • Third-party libraries FFmpeg links against but does not vendor, which need their own scope line even though most are separately in OSS-Fuzz

    Sorona

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-107696 High

    FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

  • CVE-2026-107697 Medium

    FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.

  • CVE-2026-107697 Medium

    FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.

  • CVE-2026-107698 Medium

    FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

  • CVE-2026-107696 High

    FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

  • CVE-2026-107695 High

    FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

  • CVE-2026-107695 High

    FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

  • CVE-2026-107698 Medium

    FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

About this page

This page gathers every public program listed under ffmpeg.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.