The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Nov 16, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.2Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.6.5 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade mencoderUpgrade ffmpegUpgrade kodiUpgrade ffmpeg-develUpgrade plexhometheaterUpgrade mythtvUpgrade ffmpeg1Upgrade libavUpgrade ffmpeg26Upgrade ffmpeg24Upgrade ffmpeg25Upgrade avidemux2Upgrade gstreamer-ffmpegUpgrade mplayerUpgrade ffmpeg23Upgrade avidemux26Upgrade ffmpeg-011Upgrade mythtv-frontendUpgrade ffmpeg2Upgrade ffmpeg0Upgrade avidemuxUpgrade handbrake | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libswscale4Upgrade libswscale-develUpgrade libavcodec57Upgrade libswresample2Upgrade ffmpegUpgrade libavresample-develUpgrade libavformat-develUpgrade libavdevice57Upgrade libavresample3Upgrade libswresample-develUpgrade libavutil-develUpgrade libavformat57Upgrade libavutil55Upgrade libavcodec-develUpgrade libpostproc-develUpgrade libpostproc54Upgrade libavfilter6 | Dec 18, 2015 | Nov 16, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 17, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub