CVE-2017-16840

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer…

published November 21, 2017

CVSS
—
EPSS
3%
Percentile
88.5
In the wild
Unconfirmed
What it is

⚠️ A misplaced buffer in FFmpeg's VC-2 encoder could lead to a cheeky denial of service! This flaw in versions 3.0 and 3.4 might cause some unexpected behavior. 😅 Think of it like a restaurant kitchen where the chef miscalculates the number of ingredients needed for a dish, resulting in an unexpected overflow that ruins the recipe — a little mistake can lead to a big mess! If exploited, this vulnerability can cause the system to crash, leading to service interruptions — like a movie night halted by a sudden technical glitch. Users relying on video processing could experience frustrating downtime, which nobody wants!

Put simply

Think of it like a restaurant kitchen where the chef miscalculates the number of ingredients needed for a dish, resulting in an unexpected overflow that ruins the recipe — a little mistake can lead to a big mess! This vulnerability in FFmpeg's VC-2 Video Compression encoder arises due to incorrect buffer padding when handling non-Haar wavelets, leading to potential out-of-bounds reads in memory — a recipe for chaos!

What to do

If exploited, this vulnerability can cause the system to crash, leading to service interruptions — like a movie night halted by a sudden technical glitch. Users relying on video processing could experience frustrating downtime, which nobody wants! To safeguard against this vulnerability, upgrade to the latest version of FFmpeg immediately. Regularly check for updates and apply patches to secure your video processing tools. ⚡ You've got this! Stay proactive with updates and keep your systems running smoothly! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03332 · 88.5th percentile
Published
2017-11-21T08:00Z
EPSS history
Timeline
  • 21 NOV 08:00Z
    The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer…
    cvelistv5