CVE-2017-15672

HIGH

Ffmpeg < 3.3.4 - Out-of-Bounds Read

Title source: rule

Description

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

References (6)

Scores

CVSS v3 8.8
EPSS 0.0116
EPSS Percentile 78.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE
CWE-125
Status draft

Affected Products (3)

ffmpeg/ffmpeg < 3.3.4
debian/debian_linux
debian/debian_linux

Timeline

Published Nov 06, 2017
Tracked Since Feb 18, 2026