CyberRota Analysis
AI-GeneratedFFmpeg versions 4.4 through 8.1.2 are vulnerable to an out-of-bounds memory access in the ADX audio decoder, which can be exploited by attackers through specially crafted ADX or AAX audio files that induce mid-stream channel layout changes. This vulnerability can lead to both out-of-bounds reads and writes, potentially allowing for arbitrary code execution or data corruption. Organizations using affected versions of FFmpeg, especially those handling audio processing or streaming, should prioritize patching this vulnerability to mitigate the associated risks.
Original NVD Description
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.
Related CVEs
Other vulnerabilities affecting the same vendor(s)