CVE-2017-14171

In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption

published September 7, 2017

CVSS
—
EPSS
2%
Percentile
77.9
In the wild
Unconfirmed
What it is

In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01768 · 77.9th percentile
Published
2017-09-07T06:00Z
EPSS history
Timeline
  • 07 SEP 06:00Z
    In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption
    cvelistv5