PT-2026-64155 · FFmpeg · Ffmpeg
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten decode frame(), where conversion to size t wraps the value to near SIZE MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
Correção
Integer Underflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ffmpeg