PT-2019-4946 · FFmpeg+3 · Ffmpeg+3
Kevin Backhouse
·
Published
2019-02-06
·
Updated
2026-02-06
·
CVE-2019-9721
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions 3.2 through 4.1
Description
The issue is related to a denial of service in the subtitle decoder, specifically due to the
handle open brace function in libavcodec/htmlsubtitles.c, which has a complex format argument to sscanf. This can be exploited by an attacker using specially crafted video files in Matroska format, potentially leading to a denial of service by causing excessive CPU usage.Recommendations
For FFmpeg versions 3.2 through 4.1, consider disabling the subtitle decoder or restricting the use of
handle open brace function until a patch is available. Avoid using the sscanf function with complex format arguments in the affected libavcodec/htmlsubtitles.c file to minimize the risk of exploitation.Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ffmpeg
Suse
Ubuntu