PT-2018-2801 · FFmpeg+2 · Ffmpeg+2

Paul Ch · Publicado 2018-07-21 · Atualizado 2026-02-06 · CVE-2018-1999011

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869

Description The issue is related to a buffer overflow in the dynamic memory, which can be exploited by an attacker to cause a denial of service or execute arbitrary code using a specially crafted file or stream. The vulnerability is specifically located in the asf o format demuxer and can result in a heap-buffer-overflow, potentially leading to remote code execution. This can be achieved by providing a specially crafted ASF file as input to FFmpeg.

Recommendations For FFmpeg versions prior to commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869, update to a version that includes the fix, specifically commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 or later. As a temporary workaround, consider restricting the use of the asf o format demuxer to minimize the risk of exploitation. Avoid using specially crafted ASF files that could trigger the buffer overflow until the issue is resolved.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2018-2047

BDU:2019-02098

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2018-1999011

DSA-4449-1

SUSE-SU-2018:2305-1

Produtos afetados

Alt Linux

Ffmpeg

Suse

Referências · 151

• https://github.com/FFmpeg/FFmpeg/commit/2b46ebdbff1d8dec7a3d8ea280a612b91a582869 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Nota de Segurança
• https://bugzilla.suse.com/1102689 · Nota
• https://osv.dev/vulnerability/CVE-2018-1999010 · Nota
• https://osv.dev/vulnerability/CVE-2021-38291 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999011 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13304 · Nota
• https://osv.dev/vulnerability/CVE-2020-24020 · Nota