Threats tagged 'ghsa-824f-v6qw-342h'

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder. This vulnerability allows an attacker to disclose heap memory contents by providing a crafted video file with a compressed tile that decompresses fewer bytes than expected. The flaw occurs because the decompressed byte count is not validated against the tile dimensions before copying data, potentially exposing data from prior heap allocations or previously decoded frames. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity). A patch is available for this issue.