CVE-2017-9991

Published: Jun 28, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Affected (23)

Products: Ffmpeg: Ffmpeg

Ffmpeg

1 product

Ffmpeg

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Ffmpeg Ffmpeg	Up to 2.8.11
Ffmpeg Ffmpeg	Version 3.0.1
Ffmpeg Ffmpeg	Version 3.0.2
Ffmpeg Ffmpeg	Version 3.0.3
Ffmpeg Ffmpeg	Version 3.0.4
Ffmpeg Ffmpeg	Version 3.0.5
Ffmpeg Ffmpeg	Version 3.0.6
Ffmpeg Ffmpeg	Version 3.0.7
Ffmpeg Ffmpeg	Version 3.0
Ffmpeg Ffmpeg	Version 3.1.1
Ffmpeg Ffmpeg	Version 3.1.2
Ffmpeg Ffmpeg	Version 3.1.3
Ffmpeg Ffmpeg	Version 3.1.4
Ffmpeg Ffmpeg	Version 3.1.5
Ffmpeg Ffmpeg	Version 3.1.6
Ffmpeg Ffmpeg	Version 3.1.7
Ffmpeg Ffmpeg	Version 3.1
Ffmpeg Ffmpeg	Version 3.2.1
Ffmpeg Ffmpeg	Version 3.2.2
Ffmpeg Ffmpeg	Version 3.2.3
Ffmpeg Ffmpeg	Version 3.2.4
Ffmpeg Ffmpeg	Version 3.2
Ffmpeg Ffmpeg	Version 3.3