FFmpeg vulnerabilities

Unspecified vulnerability in FFmpeg before version 0.10.3 with unknown impact and attack vectors. This is a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2780, and CVE-2012-2781.

Unspecified vulnerability in FFmpeg before version 0.10.3 with unknown impact and attack vectors. This is a different vulnerability than CVE-2012-2771, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.

Unspecified vulnerability in FFmpeg before version 0.10.3, with unknown impact and attack vectors. This is a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.

FFmpeg before January 23, 2017, has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.

FFmpeg before January 24, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.

FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.

FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.

FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c.

A heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.

A heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.

A flaw was found in FFmpeg in the tdsc_load_cursor() function, which writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to denial of service or arbitrary code execution.

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg (version N-122528-gdd2976b9e1) allows attackers to cause a Denial of Service (DoS) by supplying a crafted video file.

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution.

In FFmpeg versions from 0.5 up to, but not including, 9.0, there is an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker can supply a crafted TIFF file with a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than declared. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output.

In FFmpeg versions from 3.0 up to, but not including, 9.0, there is an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output.

In FFmpeg versions from 3.0 up to, but not including, 9.0, there is an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame.

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter. An attacker can supply a crafted PGS/SUP subtitle file with mismatched frame dimensions, causing data to be copied beyond the allocated buffer, leading to heap corruption and potential code execution.

FFmpeg through version 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. An attacker can supply a crafted PNG image with a malicious eXIf chunk, causing tens of thousands of bytes to be written past the buffer boundary, leading to heap corruption and potential code execution.

FFmpeg through version 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder. An attacker can supply a crafted CAF file with a malicious bytes_per_packet value, causing an integer overflow and undersized buffer allocation, leading to a heap out-of-bounds write and potential code execution.

FFmpeg through 8.1.2 contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, copying uninitialized heap contents into the attacker-observable AVFrame output, potentially defeating ASLR in long-lived media processing services.

FFmpeg through 8.1.2 contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

In FFmpeg up to version 8.1.2, there is a heap out-of-bounds write vulnerability in the vf_hqdn3d filter. An attacker can supply a crafted video where frame resolution increases between frames and filter reinitialization is disabled, leading to heap memory corruption.

An out-of-bounds write vulnerability in the vf_swaprect video filter in FFmpeg versions 3.0 through 8.1.2. An attacker can supply a crafted NV12 frame with odd width, causing heap corruption and potential code execution.

A vulnerability in the vf_floodfill video filter in FFmpeg versions 3.4 through 8.1.2 causes an out-of-bounds write on the heap. When config_input() allocates a stack based on initial frame dimensions and a larger frame is processed, filter_frame() pushes neighbors beyond the original allocation, leading to heap corruption and potential code execution.

A vulnerability in FFmpeg through version 8.1.2 allows heap corruption via a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, resulting in a negative size that, when converted to size_t in shorten_decode_frame(), causes reads beyond the source and writes beyond the Shorten decoder's bitstream buffer.

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder. An attacker can supply a crafted ADX or AAX audio file with a mid-stream channel layout change, causing the use of a stale channel count and out-of-bounds memory access.

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer (libavformat/rtpdec_asf.c). The rtp_asf_fix_header function fails to validate a minimum chunksize, allowing a remote attacker to send a crafted RTP/ASF stream causing CPU exhaustion and denial of service.

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer. An attacker can supply a crafted DTS stream with a core_size larger than the actual packet length, causing unauthorized memory reads.

A double-free vulnerability in the NVIDIA NVDEC hardware decoder in FFmpeg versions 4.4 through 8.1.2. Attackers can trigger memory corruption by supplying a crafted video file, causing a double-free of the decoder context.

In FFmpeg versions 8.0 through 8.1.2, a stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder. A remote attacker can supply a crafted HEVC/H.265 bitstream with a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, causing overflow of stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability in the VobSub subtitle demuxer. Supplying a malicious .sub/.idx file with excessive stream IDs can cause out-of-bounds writes and potential code execution.

An out-of-bounds read vulnerability in FFmpeg within Google Chrome prior to version 150.0.7871.47 allows a remote attacker to read sensitive information from process memory by crafting a malicious video file.

FFmpeg's RASC video decoder performs 32-bit reads/writes before row-boundary checks and validates DLTA region in pixels instead of bytes. A crafted RASC stream can cause out-of-bounds heap write and read, leading to memory corruption.

Vulnerability in FFmpeg's libavcodec library, in the MagicYUV decoder, causing an out-of-bounds write. This can lead to denial of service and, in some cases, remote code execution.