Description
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
References (6)
Core 6
Core References
Patch, Third Party Advisory x_refsource_misc
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
Broken Link vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/107382
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3967-1/
Mailing List, Third Party Advisory mailing-list
x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/60
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2019/dsa-4449
Patch, Third Party Advisory x_refsource_misc
https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21
Scores
CVSS v3
6.5
EPSS
0.0159
EPSS Percentile
81.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (6)
canonical/ubuntu_linux
18.04
canonical/ubuntu_linux
18.10
canonical/ubuntu_linux
19.04
debian/debian_linux
9.0
ffmpeg/ffmpeg
3.2
ffmpeg/ffmpeg
4.1
Published
Mar 12, 2019
Tracked Since
Feb 18, 2026