EUVD-2026-48371
GHSA-98cx-cw6c-5pj4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file processing with victim interaction (AV:L/UI:R), no privileges needed (PR:N), and heap corruption enabling code execution justifies High C/I/A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
AnalysisAI
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to process an attacker-supplied ffconcat/concat file with the -safe 0 flag explicitly enabled (the default -safe 1 blocks the referenced-file path), and the referenced content must be a TY container routed to the Shorten (SHN) decoder so that demux_audio() produces the negative size consumed by shorten_decode_frame()'s memcpy(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.3 (High) reflects a local vector (AV:L) with passive user interaction (UI:P) and an attack requirement (AT:P), meaning exploitation is not trivial remote-unauthenticated - a victim must process attacker-supplied media with a specifically dangerous flag (-safe 0). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious ffconcat playlist referencing a TY container with a manipulated audio packet size and delivers it to a media-processing service or user that runs FFmpeg with the -safe 0 flag. When the file is demuxed, demux_audio() produces a negative packet size that wraps in shorten_decode_frame()'s memcpy(), corrupting the heap beyond the decoder's bitstream buffer and potentially leading to arbitrary code execution. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor patch from commit de771bd52774a52d45b0e2c82e56995a1ef40df7 (PR 23767 at https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767) by upgrading to a build that incorporates it beyond 8.1.2, and consult the VulnCheck advisory (https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems running FFmpeg to identify current versions in use and locate dependent applications or microservices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today