CVE-2021-3566CWE-200

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it

published August 5, 2021

CVSS
—
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00880 · 58.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-08-05T20:21Z
EPSS history
Timeline
  • 05 AUG 20:21Z
    Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it
    cvelistv5