121 results · Clear filters · Feed
-
Medium 4.7
FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL …
-
Medium 5.5
FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a …
-
Medium 4.7
FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slice…
-
Medium 5.5
FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points
FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI me…
-
Medium 5.5
FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units …
-
Medium 4.8
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because c…
-
Medium 5.5
FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG…
-
Medium 4.8
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c tha…
-
Medium 6.9
FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, whic…
-
Medium 5.5
FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an ov…
-
Medium 5.5
FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper
FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only pa…
-
Medium 6.1
FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NA…
-
Medium 4.8
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targ…
-
Medium 6.1
FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame…
-
Medium 5.5
FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c
FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nb…
-
Medium 4.8
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that res…
-
Medium 4.8
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/e…
-
Medium 4.8
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c t…
-
Medium 4.8
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows …
-
Medium 5.5
FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder
FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits ne…
-
Medium 4.7
FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, ov…
-
Medium 4.7
FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu …
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte …
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowin…
-
Medium 4.7
FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, ca…
-
Medium 5.5
FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causi…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter fr…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR fra…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk…
-
Medium 5.5
FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …
-
Medium 5.5
FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palet…
-
Medium 5.5
FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, R…
-
Medium 5.5
FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompre…
-
Medium 5.5
FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kem…
-
Medium 4.3
FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux…
-
Medium 4.3
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use …
-
Medium 5.4
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to inter…
-
Medium 6.5
FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or …
-
Medium 6.5
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a cra…
-
Medium 4.7
FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a craft…