Description
Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:3.2.2-1 | — |
| Debian 13 | ffmpeg | 7:3.2.2-1 | — |
| Debian 12 | ffmpeg | 7:3.2.2-1 | — |
| Debian 8 | libav | 6:11.12-1~deb8u2 | DLA-1611-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ffmpeg | 7:2.8.11-0ubuntu0.16.04.1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libav | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP2 | ffmpeg | 3.1.6-5.1 | openSUSE-SU-2017:0961-1, openSUSE-SU-2017:0958-1 |
| SUSE Package Hub 12 SP1 | ffmpeg | 3.1.6-5.1 | openSUSE-SU-2017:0961-1, openSUSE-SU-2017:0958-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ffmpeg-4 | 4.4-5.2 | openSUSE-SU-2024:10754-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.4 | ffmpeg | 3.0.7-r0 | — |
| Alpine v3.3 | ffmpeg | 2.8.11-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
muzalam/FFMPEG-exploit ★ 3 · May 7, 2022
FFMPEG heap overflow exploit CVE-2016-10190
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- DLA-1611-1 libav - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10754-1 ffmpeg-4-4.4-5.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:0961-1 Security update for ffmpeg SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:0958-1 Security update for ffmpeg SUSE / openSUSE Security Updates · May 7, 2025
References
- [debian-lts-announce] 20181220 [SECURITY] [DLA 1611-1] libav security update mailing-list
- [oss-security] 20170201 CVE Request: ffmpeg remote exploitaion results code execution mailing-list
- [oss-security] 20170202 Re: CVE Request: ffmpeg remote exploitaion results code execution mailing-list
- https://github.com/FFmpeg/FFmpeg/commit/2a05c8f813de6f2278827734bf8102291e7484aa
- https://trac.ffmpeg.org/ticket/5992
- 95986 vdb-entry
- https://ffmpeg.org/security.html