Threat Intelligence Database

FFmpeg versions through 8.1.2 contain a heap out-of-bounds write vulnerability in the vf_hqdn3d filter. This occurs when a crafted video input with increasing frame resolution is processed with filtergraph reinitialization disabled (-reinit_filter 0). The vulnerability allows heap memory corruption due to undersized buffer allocation for line-history, leading to out-of-bounds writes during denoising. This issue is fixed in commit 5d7112c.

FFmpeg versions through 8.1.2 contain a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. This flaw is triggered by a crafted PNG image with a malicious eXIf chunk that causes excessive memory writes beyond allocated buffers. The vulnerability can lead to deterministic heap corruption, process crashes, and potentially arbitrary code execution. The issue was fixed in a commit identified as b506faf. No explicit affected versions were provided beyond 'through 8.1.2'.

FFmpeg versions through 8.1.2 contain a signed integer overflow vulnerability in the MACE6 audio decoder. This flaw allows attackers to craft a malicious CAF audio file with specially manipulated bytes_per_packet and frames_per_packet values. The vulnerability triggers an integer overflow during output sample count calculation, causing an undersized buffer allocation and a heap out-of-bounds write. This memory corruption could potentially enable code execution. The issue was fixed in commit aafb5c6.

FFmpeg versions through 8.1.2 contain an information disclosure vulnerability in the LCL/ZLIB video decoder. This flaw allows attackers to expose uninitialized heap memory by providing a valid zlib stream that decompresses to fewer bytes than the expected frame size. The vulnerability arises because the decompression function treats short decompression as non-fatal and proceeds to copy a full frame's worth of data from the allocation buffer, potentially leaking sensitive memory contents. This may aid attackers in bypassing address space layout randomization (ASLR) in long-running media processing services.

FFmpeg versions 7.0 through 8.1.2 contain a heap out-of-bounds write vulnerability in the vf_quirc filter. This flaw arises when processing crafted PGS/SUP subtitle files with mismatched frame dimensions, leading to heap corruption and potential process crashes or code execution. The vulnerability is fixed in commit 4da9812.

FFmpeg versions through 8.1.2 contain an uncontrolled resource consumption vulnerability in the IAMF demuxer. An unauthenticated attacker can supply a crafted count_label field in a small input file to trigger excessive memory allocation, leading to process memory exhaustion or out-of-memory termination during format probing. The vulnerability is fixed in commit 5d7112c.

FFmpeg versions through 8.1.2 contain an out-of-bounds write vulnerability in the TY demuxer's demux_audio() function. This flaw occurs when processing a crafted ffconcat file with the -safe 0 flag, leading to heap corruption due to improper bounds checking and a negative packet size value that wraps to a large size_t value. This causes reads and writes beyond allocated buffers in the Shorten decoder's bitstream buffer.

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter. This occurs when processing crafted NV12 video frames with odd width dimensions, leading to heap memory corruption and potential process crashes. The issue arises from a buffer size mismatch during a memcpy operation in the filter_frame() function. This vulnerability can potentially allow code execution.

FFmpeg versions from 3.4 up to and including 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter. This flaw occurs when processing dynamically sized video streams with filtergraph reinitialization disabled, leading to heap memory corruption. The vulnerability can cause process crashes and may allow code execution depending on the heap layout and system hardening.

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder. This flaw arises when processing crafted AVI files that change frame dimensions across TDSF frames, leading to heap corruption. The vulnerability is due to the tdsc_parse_tdsf() function not properly unreferencing existing reference frames before buffer allocation, causing subsequent functions to write beyond buffer boundaries. This can result in a process crash and potentially allow remote code execution.