CyberRota Analysis
AI-GeneratedFFmpeg versions up to 8.1.2 are vulnerable to an out-of-bounds write due to improper handling of packet sizes in the TY demuxer's demux_audio() function when processing crafted ffconcat files with the -safe 0 flag. This flaw can lead to heap corruption, potentially allowing attackers to execute arbitrary code or crash the application. Organizations using FFmpeg for media processing should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.
Related CVEs
Other vulnerabilities affecting the same vendor(s)