Description
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:2.6.1-1 | — |
| Debian 13 | ffmpeg | 7:2.6.1-1 | — |
| Debian 12 | ffmpeg | 7:2.6.1-1 | — |
| Debian 8 | libav | 6:11.4-1~deb8u1 | DSA-3288-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libav | 6:9.20-0ubuntu0.14.04.1+esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libav-tools | 12.3-1.17 | openSUSE-SU-2024:10926-1 |
Advisories 2
- DSA-3288-1 libav - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10926-1 libav-tools-12.3-1.17 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4
- GLSA-201705-08 vendor-advisory
- 1032198 vdb-entry
- DSA-3288 vendor-advisory
- 74385 vdb-entry
- https://github.com/FFmpeg/FFmpeg/commit/e8714f6f93d1a32f4e4655209960afcf4c185214
- 20150414 several issues in SQLite (+ catching up on several other bugs) mailing-list