FFmpeg 9.0.3 as listed for the NVIDIA NIM LLM 2.1.6 serving-stack images
(vLLM and SGLang; LGPL-2.1-or-later build).

Scanners list this FFmpeg build as version 9.0.3. Its full version string is 9.0.3+dev.9.0.2.p1.eb9cef3: it is the
FFmpeg 9.0.2 release with one upstream fix applied, and the string records base release 9.0.2, NVIDIA patch level 1
and eb9cef3, the commit ID of the applied fix. It is not an FFmpeg 9.0.3 release (none had been published when this
page was made), and apart from that one fix it contains no code from later FFmpeg versions.

Corresponding source:
  ffmpeg-9.0.2.tar.xz      the signed upstream release (https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz,
                           sha256 8c3850283eb25fa026482078a04051e0be17347b09ef81a0849bec15a96e002e)
  ffmpeg-9.0.2.tar.xz.asc  its upstream signature (FFmpeg release key FCF986EA15E6E293A5644F10B4322F04D67658D8)
  0001-avformat-rtsp-limit-the-number-of-redirects.patch
                           the fix for CVE-2026-107696 from FFmpeg pull request #24902 (commit
                           eb9cef3ef1f6adac1e701e3f5f06739a0fcb0c97; merged into FFmpeg master as
                           f5d4fd186c68913240c4f6e9cda98443e1518b34), applied with `patch -p1` to the extracted
                           tarball; the build then writes 9.0.3+dev.9.0.2.p1.eb9cef3 to VERSION.

Both FFmpeg builds in these images use this source: the shared libraries in /usr/local/lib (libav*/libsw* with the
-nimlgpl suffix; both images) and the libavformat/libavutil inside the pynvvideocodec 2.2.3+nim.0af96e39 wheel
(vLLM image). Neither build enables GPL or nonfree components. They are configured and built by
docker/scripts/build_ffmpeg_lgpl.sh (NVIDIA nim-llm, commit bd4a9681) and by ci/build_ffmpeg.sh (NVIDIA
PyNvVideoCodec build repository, commit 0af96e39). The second script is in the pynvvideocodec 2.2.3+nim.0af96e39
source on this site.