CVE-2023-39018

CriticalCVSS 9.8

Published: 28/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.78%

51th percentile - higher than 51% of all known CVEs

Summary

FFmpeg version 0.7.0 and below contains a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited by passing an unchecked argument.

Risk Assessment

This vulnerability could lead to unauthorized code execution; however, there are disputes regarding realistic use cases for exploiting it in practice.

Recommendation

It is recommended to update FFmpeg to the latest version to minimize the risk associated with this vulnerability.

Original NVD description (English source)

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.