PT-2018-4001 · FFmpeg+1 · Ffmpeg+1

Alexandru Razvan Caciulescu + 3 · Published 2018-07-05 · Updated 2026-02-06 · CVE-2018-13304

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.0.1

Description The issue is related to improper maintenance of consistency between the context profile field and studio profile in libavcodec, which may trigger an assertion failure when converting a crafted AVI file to MPEG4. This can lead to a denial of service. The affected components include error resilience.c, h263dec.c, and mpeg4videodec.c. A remote attacker can exploit this issue using a specially crafted AVI file.

Recommendations For FFmpeg version 4.0.1, consider disabling the affected components, such as error resilience.c, h263dec.c, and mpeg4videodec.c, as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2018-2047

BDU:2024-09061

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2018-13304

Affected Products

Alt Linux

Ffmpeg

References · 134

• https://github.com/FFmpeg/FFmpeg/commit/bd27a9364ca274ca97f1df6d984e88a0700fb235 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-35965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12284 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13304 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-13304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999011 · Security Note