CVE-2019-12730

CRITICAL

Ffmpeg < 3.2.14 - Use of Uninitialized Resource

Title source: rule

Description

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

References (9)

Scores

CVSS v3 9.8
EPSS 0.0167
EPSS Percentile 82.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-908
Status published
Products (1)
ffmpeg/ffmpeg < 3.2.14
Published Jun 04, 2019
Tracked Since Feb 18, 2026