CyberRota Analysis
AI-GeneratedFFmpeg versions 3.0 through 8.1.2 are vulnerable to an out-of-bounds write in the vf_swaprect video filter, which can be exploited by attackers using specially crafted NV12 video frames with odd width dimensions. This flaw can lead to heap memory corruption, potentially allowing for code execution and process crashes. Organizations utilizing affected FFmpeg versions, particularly those handling video processing, should prioritize patching this vulnerability to mitigate the associated risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)