CyberRota Analysis
AI-GeneratedFFmpeg versions 2.7 through 8.1.2 are vulnerable to an out-of-bounds write in the TDSC video decoder, which can be exploited by remote attackers through specially crafted AVI files. This vulnerability can lead to heap corruption, resulting in application crashes and potential arbitrary code execution. Organizations using affected FFmpeg versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)