EUVD-2026-48372
GHSA-gf7r-r5xq-r3hm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-processing vector (AV:L) with victim interaction (UI:R); AC:H reflects the required non-default -reinit_filter 0 plus an upward frame-size change; impacts high given potential code execution.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
AnalysisAI
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to run the FFmpeg vf_floodfill filter with filtergraph reinitialization explicitly disabled via the -reinit_filter 0 option - a non-default configuration - and to process a dynamically sized video stream in which a frame larger than the initial frame arrives after config_input() has fixed the traversal stack size. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) scores 7.3 and tells a consistent story of meaningful-but-constrained risk: exploitation is local (the attacker supplies a file rather than reaching the process over a network), requires no privileges, but depends on both a passive user interaction (processing the media) and an attack requirement (AT:P) - here the non-default -reinit_filter 0 setting combined with a size-changing stream. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a video file whose stream begins with small frame dimensions and later switches to larger dimensions, then delivers it to a victim or service that transcodes it through an FFmpeg filtergraph using the floodfill filter with -reinit_filter 0. When the larger frame reaches filter_frame(), neighbor pushes overflow the undersized traversal stack, corrupting the heap and crashing the process, with potential for code execution depending on heap layout. … |
| Remediation | Patch available per vendor advisory: apply the upstream FFmpeg fix committed at https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c (merged via PR https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780) and rebuild or upgrade to a release that incorporates it; a released patched version number was not independently confirmed from the provided data, so verify the fixed tag against the VulnCheck advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems running FFmpeg versions 3.4 through 8.1.2, with priority on production media processing services and any systems applying dynamic filtergraphs to external video sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today