A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Dec 5, 2025 | Aug 6, 2024 |
| Debian | — | Upgrade ffmpeg | Aug 15, 2024 | Aug 6, 2024 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.4.5Upgrade to FFmpeg version 7.0.2Upgrade to FFmpeg version 4.3.8Upgrade to FFmpeg version 6.1.2Upgrade to FFmpeg version 5.1.6Upgrade to FFmpeg version 7.1 | Aug 6, 2024 | Aug 6, 2024 |
| Suse | — | Upgrade ffmpeg-4-libpostproc-develUpgrade libavcodec58_134Upgrade libswresample5Upgrade libavcodec58_134-32bitUpgrade libavdevice58_13-32bitUpgrade ffmpeg-4-private-develUpgrade libavformat58_76Upgrade ffmpeg-4Upgrade libavfilter7_110-32bitUpgrade libavresample4_0Upgrade libavfilter10Upgrade libavcodec61Upgrade ffmpeg-4-libavutil-develUpgrade libavutil59Upgrade libswscale5_9-32bitUpgrade libswresample3_9Upgrade ffmpeg-4-libavcodec-develUpgrade libavdevice58_13Upgrade libpostproc58Upgrade ffmpeg-4-libavdevice-develUpgrade libswscale8Upgrade libavutil56_70-32bitUpgrade libpostproc55_9-32bitUpgrade ffmpeg-4-libswresample-develUpgrade ffmpeg-4-libavresample-develUpgrade ffmpeg-4-libswscale-develUpgrade ffmpeg-7Upgrade libswscale5_9Upgrade libavutil56_70Upgrade libpostproc55_9Upgrade libavresample4_0-32bitUpgrade ffmpeg-4-libavfilter-develUpgrade libavdevice61Upgrade ffmpeg-4-libavformat-develUpgrade libavformat61Upgrade libavformat58_76-32bitUpgrade libavfilter7_110Upgrade libswresample3_9-32bit | Dec 30, 2024 | Aug 6, 2024 |
| Ubuntu | — | Upgrade libavcodec-dev (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro) | Jun 26, 2025 | Aug 6, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub