Description
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability allows attackers to cause undefined behavior within the application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:7.0.1-3 | — |
| Debian 13 | ffmpeg | 7:7.0.1-3 | — |
Advisories 1
- WID-SEC-2024-0923 ffmpeg: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Aug 25, 2025
References
- https://github.com/ffmpeg/ffmpeg/commit/ce0c178a408d43e71085c28a47d50dc939b60196
- https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/cbs_h266_syntax_template.c#L2048
- https://gist.github.com/1047524396/a7e9273e12553775826784035333cdd8
- FEDORA-2024-92780a83f9 vendor-advisory
- FEDORA-2024-55e7e839f1 vendor-advisory
- FEDORA-2024-3a548f46a8 vendor-advisory