A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-mpv | Oct 1, 2024 | May 18, 2021 | |
| Debian | debian-upgrade-mpv | Jul 30, 2024 | May 18, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-media-video-mpv | Jul 21, 2021 | May 18, 2021 | |
| Suse | — | suse-upgrade-libmpv1suse-upgrade-mpvsuse-upgrade-mpv-bash-completionsuse-upgrade-mpv-develsuse-upgrade-mpv-zsh-completion | May 26, 2021 | May 18, 2021 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | May 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub