PT-2019-4614 · FFmpeg+3 · Ffmpeg+3

Kevin Backhouse · Published 2019-01-06 · Updated 2026-02-06 · CVE-2019-9718

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.2 through 4.1

Description The issue is related to a denial of service in the subtitle decoder, allowing attackers to consume excessive CPU resources via a crafted video file in Matroska format. This is due to the ff htmlmarkup to ass function in libavcodec/htmlsubtitles.c having a complex format argument to sscanf. The vulnerability is also associated with a buffer overflow read in the ff htmlmarkup to ass function of the FFmpeg multimedia library. Exploitation of this issue may enable a remote attacker to cause a denial of service using a specially crafted video file in Matroska format.

Recommendations For FFmpeg versions 3.2 through 4.1, consider disabling the ff htmlmarkup to ass function as a temporary workaround until a patch is available. Restrict access to Matroska video files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1275

BDU:2020-00748

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2019-9718

DSA-4449-1

SUSE-SU-2019:3184-1

SUSE-SU-2019:3184-2

USN-3967-1

Affected Products

Alt Linux

Ffmpeg

Suse

Ubuntu

References · 158

• https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-7751 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000016 · Security Note
• https://usn.ubuntu.com/3967-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9718 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-9718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-13302 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12284 · Security Note