The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.5.8Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.4.11 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade ffmpeg2Upgrade mencoderUpgrade kodiUpgrade avidemux2Upgrade libavUpgrade ffmpeg1Upgrade ffmpeg-011Upgrade mythtv-frontendUpgrade ffmpeg24Upgrade ffmpeg-develUpgrade gstreamer-ffmpegUpgrade mythtvUpgrade handbrakeUpgrade avidemuxUpgrade gstreamer1-libavUpgrade plexhometheaterUpgrade avidemux26Upgrade mplayerUpgrade ffmpeg0Upgrade ffmpeg25Upgrade ffmpegUpgrade ffmpeg26Upgrade ffmpeg23 | Dec 10, 2025 | Sep 20, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub