Description
In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:2.2.1-1 | — |
| Debian 13 | ffmpeg | 7:2.2.1-1 | — |
| Debian 12 | ffmpeg | 7:2.2.1-1 | — |
| Debian 8 | libav | 6:11.12-1~deb8u1 | DSA-4119-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libav | No fix yet | — |
Advisories 1
- DSA-4119-1 libav - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-4119 vendor-advisory
- GLSA-201811-19 vendor-advisory
- https://bugzilla.libav.org/show_bug.cgi?id=1098
- 101882 vdb-entry
- https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f