CVE-2017-16840

Critical

Published: 21/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The VC-2 Video Compression encoder in FFmpeg versions 3.0 and 3.4 contains a flaw that allows remote attackers to cause a denial of service (out-of-bounds read) due to incorrect buffer padding for non-Haar wavelets.

Risk Assessment

Attackers may exploit this vulnerability to disrupt system operations, potentially leading to downtime in video processing services.

Recommendation

It is recommended to update FFmpeg to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Original NVD description (English source)

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.