The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Jun 16, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.2Upgrade to FFmpeg version 2.0.7Upgrade to FFmpeg version 2.7Upgrade to FFmpeg version 2.4.8Upgrade to FFmpeg version 2.1.8Upgrade to FFmpeg version 2.2.15Upgrade to FFmpeg version 2.5.6 | Sep 29, 2017 | Jun 16, 2015 |
| Freebsd | — | Upgrade avidemuxUpgrade kodiUpgrade ffmpeg1Upgrade handbrakeUpgrade ffmpeg25Upgrade avidemux26Upgrade ffmpeg23Upgrade ffmpeg24Upgrade ffmpeg26Upgrade ffmpegUpgrade mythtvUpgrade gstreamer1-libavUpgrade libavUpgrade mythtv-frontendUpgrade mencoderUpgrade mplayer | Dec 10, 2025 | Sep 1, 2015 |
| Gentoo Linux | — | Upgrade media-video/libav.Upgrade media-video/ffmpeg. | Oct 30, 2017 | Jun 16, 2015 |
| Ubuntu | — | Upgrade libavformat53Upgrade libavcodec53 | Apr 4, 2016 | Jun 16, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub