The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Jun 16, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.0.7Upgrade to FFmpeg version 2.6.2Upgrade to FFmpeg version 2.1.8Upgrade to FFmpeg version 2.4.8Upgrade to FFmpeg version 2.2.15Upgrade to FFmpeg version 2.7Upgrade to FFmpeg version 2.5.6 | Sep 29, 2017 | Jun 16, 2015 |
| Freebsd | — | Upgrade gstreamer1-libavUpgrade libavUpgrade mythtvUpgrade ffmpeg24Upgrade mplayerUpgrade mencoderUpgrade ffmpeg26Upgrade ffmpegUpgrade avidemux26Upgrade ffmpeg23Upgrade mythtv-frontendUpgrade ffmpeg25Upgrade kodiUpgrade ffmpeg1Upgrade avidemuxUpgrade handbrake | Dec 10, 2025 | Sep 1, 2015 |
| Gentoo Linux | — | Upgrade media-video/libav.Upgrade media-video/ffmpeg. | Oct 30, 2017 | Jun 16, 2015 |
| Ubuntu | — | Upgrade libavformat53Upgrade libavcodec53 | Apr 4, 2016 | Jun 16, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub