Sign In
Advisories

FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c

Go back
Severity
high
Date
Affecting

  • FFmpeg >= 0, < 8.1.3

  • FFmpeg >= 9.0, < 9.0.2

CWE
  • CWE-131 Incorrect Calculation of Buffer Size
CVSS
8.5
CVSS V4 Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
Zheng Yu @ Depthfirst, Joshua Rogers (AISLE Research), Michael Niedermayer
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo