CVE-2023-6604: fedora · Resource Injection
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 6 Jan 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2023-6604, European organizations should: 1) Avoid using FFmpeg version 2.0 for processing untrusted or external multimedia inputs, especially those involving XBIN-formatted data. 2) Implement strict input validation and sanitization to ensure that only properly formatted and verified media files are processed. 3) Monitor CPU and storage resource usage on systems running FFmpeg to detect abnormal spikes indicative of exploitation attempts. 4) Employ network-level filtering to restrict or inspect incoming media streams from untrusted sources. 5) Consider sandboxing or isolating FFmpeg processes to limit the impact of potential resource exhaustion. 6) Stay updated with FFmpeg project announcements for patches or newer versions addressing this vulnerability and plan timely upgrades. 7) Conduct regular security assessments and penetration tests focusing on media processing components. These measures go beyond generic advice by focusing on input validation, resource monitoring, and process isolation specific to the nature of this vulnerability.
Description
A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.