The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.4.11Upgrade to FFmpeg version 2.5.8 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade mencoderUpgrade avidemux26Upgrade mplayerUpgrade ffmpeg26Upgrade mythtvUpgrade libavUpgrade mythtv-frontendUpgrade avidemuxUpgrade gstreamer-ffmpegUpgrade ffmpeg23Upgrade ffmpeg-develUpgrade ffmpegUpgrade gstreamer1-libavUpgrade plexhometheaterUpgrade ffmpeg24Upgrade avidemux2Upgrade handbrakeUpgrade ffmpeg0Upgrade ffmpeg1Upgrade ffmpeg2Upgrade ffmpeg25Upgrade ffmpeg-011Upgrade kodi | Dec 10, 2025 | Sep 20, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub