CVE-2017-9996

Published: Jun 28, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Affected (34)

Products: Ffmpeg: Ffmpeg

Ffmpeg

1 product

Ffmpeg

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Ffmpeg Ffmpeg	Version 2.8.10
Ffmpeg Ffmpeg	Version 2.8.11
Ffmpeg Ffmpeg	Version 2.8.1
Ffmpeg Ffmpeg	Version 2.8.2
Ffmpeg Ffmpeg	Version 2.8.3
Ffmpeg Ffmpeg	Version 2.8.4
Ffmpeg Ffmpeg	Version 2.8.5
Ffmpeg Ffmpeg	Version 2.8.6
Ffmpeg Ffmpeg	Version 2.8.7
Ffmpeg Ffmpeg	Version 2.8.8
Ffmpeg Ffmpeg	Version 2.8.9
Ffmpeg Ffmpeg	Version 2.8
Ffmpeg Ffmpeg	Version 3.0.1
Ffmpeg Ffmpeg	Version 3.0.2
Ffmpeg Ffmpeg	Version 3.0.3
Ffmpeg Ffmpeg	Version 3.0.4
Ffmpeg Ffmpeg	Version 3.0.5
Ffmpeg Ffmpeg	Version 3.0.6
Ffmpeg Ffmpeg	Version 3.0.7
Ffmpeg Ffmpeg	Version 3.0
Ffmpeg Ffmpeg	Version 3.1.1
Ffmpeg Ffmpeg	Version 3.1.2
Ffmpeg Ffmpeg	Version 3.1.3
Ffmpeg Ffmpeg	Version 3.1.4
Ffmpeg Ffmpeg	Version 3.1.5
Ffmpeg Ffmpeg	Version 3.1.6
Ffmpeg Ffmpeg	Version 3.1.7
Ffmpeg Ffmpeg	Version 3.1
Ffmpeg Ffmpeg	Version 3.2.1
Ffmpeg Ffmpeg	Version 3.2.2
Ffmpeg Ffmpeg	Version 3.2.3
Ffmpeg Ffmpeg	Version 3.2.4
Ffmpeg Ffmpeg	Version 3.2
Ffmpeg Ffmpeg	Version 3.3