Adrian Junge

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 0.5 through 8.x **Description** A signed integer overflow exists in the DVB subtitle parser within `libavcodec/dvbsub parser.c`. An attacker can trigger a heap buffer overflow by providing a specially crafted WTV file. This occurs when a bounds-check guard expression wraps to `INT MIN`, bypassing the `PARSE BUF SIZE` comparison. Consequently, the `memcpy()` function is called with attacker-controlled data, leading to an out-of-bounds heap write, which may result in memory corruption or arbitrary code execution. **Recommendations** Update FFmpeg to version 9.0 or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 4.4 through 8.x **Description** An out-of-bounds heap write exists in the native GoPro CineForm HD (CFHD) decoder. A remote attacker can corrupt heap memory by providing a specially crafted AVI file during stream probing. The issue occurs because the `cfhd decode()` function does not enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path. This leads the `horiz filter clip()` function to write oversized 16-bit sample rows beyond the allocated output frame buffer, which may allow arbitrary code execution by overwriting a live cleanup callback pointer. **Recommendations** Update FFmpeg to version 9.0 or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 0.5 through 8.x **Description** An uninitialized heap memory disclosure exists in the native TIFF decoder within libavcodec/tiff.c. An attacker can exploit this by providing a crafted TIFF file containing a valid Deflate-compressed strip that produces fewer bytes than declared. The `tiff unpack zlib()` function allocates a heap buffer for the full declared strip but uses `memcpy()` to copy all declared rows regardless of the actual bytes decompressed by zlib. This process incorporates unwritten bytes containing stale data from previous heap allocations into the decoded image output, which may expose sensitive information in persistent services. **Recommendations** Update FFmpeg to version 9.0 or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 3.0 through 8.x **Description** An uninitialized heap memory read exists in the native Screenpresso decoder (`libavcodec/screenpresso.c`). An attacker can recover sensitive memory contents, such as userspace addresses from persistent decoding services, by providing a crafted SPV1 packet containing a valid zlib stream that decompresses fewer bytes than the full frame requires. This occurs because the `screenpresso decode frame()` function does not validate the produced byte count before calling `av image copy plane()` to copy the frame dimensions from the `ctx->inflated buf` buffer, resulting in unwritten heap memory from previous allocations or frames being copied into the decoded output. **Recommendations** Update to version 9.0 or later. As a temporary mitigation, restrict the use of the Screenpresso decoder in `libavcodec/screenpresso.c`.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 3.0 through 8.x **Description** The native RSCC decoder in `libavcodec/rscc.c` contains an uninitialized heap memory read issue. An attacker can disclose heap memory contents by providing a specially crafted video file containing a compressed tile that decompresses fewer bytes than the declared tile geometry requires. This occurs when the `rscc decode frame()` function calls `av image copy plane()` without validating the decompressed byte count against the tile dimensions. Consequently, the unwritten suffix of the persistent intermediate buffer `ctx->inflated buf` is copied into the decoded frame, which may expose data from previous heap allocations or previously decoded frames in persistent decoding services. **Recommendations** Update to version 9.0 or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** An information disclosure issue exists in the LCL/ZLIB video decoder. An attacker can expose uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than the expected frame size. The `zlib decomp()` function in `lcldec.c` treats short decompression as non-fatal and proceeds to the RGB24 conversion path. This process copies a full frame of rows from the allocation buffer based on original frame dimensions, resulting in uninitialized heap contents, such as pointer-derived allocator bytes, being copied into the AVFrame output. This could potentially defeat Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to prevent exploitation. **Recommendations** Update FFmpeg to the version containing commit 8670835.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** A heap out-of-bounds write exists in the `vf hqdn3d` filter. This occurs when filtergraph reinitialization is disabled using the `-reinit filter 0` option. An attacker can provide a crafted video where the frame resolution increases between frames. In this scenario, the `config input()` function allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause the `denoise spatial()` function to write beyond the allocated boundary, leading to heap memory corruption. **Recommendations** Update to the version containing commit 5d7112c. Avoid using the `-reinit filter 0` option when processing untrusted video inputs.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** The IAMF demuxer contains an issue that allows an unauthenticated attacker to cause multi-gigabyte memory allocation using a small 17-byte input file. This occurs because the `mix presentation obu()` function in libavformat/iamf parse.c calls `av calloc()` using a crafted `count label` field before validating the available OBU (OpenGL Binary Object) data. This leads to an allocation amplification of approximately 126 million bytes per input byte, which can exhaust process memory or trigger an OOM-kill (Out-Of-Memory killer, a kernel process that terminates processes to free memory) during format probing. **Recommendations** Update to the version containing commit 5d7112c. As a temporary workaround, restrict the use of the IAMF demuxer to process untrusted files.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** The MACE6 audio decoder contains a signed integer overflow that allows heap memory corruption via a crafted CAF file. By providing oversized `bytes per packet` and `frames per packet` values in the desc chunk, an attacker can trigger an integer overflow in the `mace decode frame()` function during the computation of the output sample count. This leads to an undersized buffer allocation and a heap out-of-bounds write, which could potentially enable arbitrary code execution. **Recommendations** Update to the version containing commit aafb5c6. As a temporary mitigation, avoid processing CAF files using the MACE6 audio decoder.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** A heap out-of-bounds write exists in the native PNG and APNG encoders. A remote attacker can corrupt heap memory by providing a crafted PNG image containing a malicious eXIf chunk. By creating an eXIf chunk where multiple IFD (Image File Directory) entries reference the same large value payload, the canonical serialization expands the output beyond the allocation estimated by the `add exif profile size()` function. This causes the `png write chunk()` function to write data past the buffer boundary, leading to deterministic heap corruption, process crashes, and potentially arbitrary code execution. **Recommendations** Update to the version containing commit b506faf.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 7.0 through 8.1.2 **Description** A heap out-of-bounds write exists in the `vf quirc` filter. An attacker can corrupt heap memory by providing a crafted PGS/SUP subtitle file with mismatched frame dimensions, specifically where the second presentation has larger dimensions than the first. This causes the `av image copy plane()` function to copy data exceeding the initial allocation size into an undersized libquirc grayscale image buffer, leading to a process crash and potential arbitrary code execution. **Recommendations** Update FFmpeg to the version containing commit 4da9812. As a temporary mitigation, avoid processing PGS/SUP subtitle files using the `vf quirc` filter.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 3.4 through 8.1.2 **Description** An out-of-bounds write issue exists in the `vf floodfill` video filter. This occurs when a dynamically sized video stream is supplied while filtergraph reinitialization is disabled via `-reinit filter 0`. The `config input()` function allocates the points traversal stack based on the initial frame dimensions; if a subsequent larger frame is processed, the `filter frame()` function performs flood-fill neighbor pushes beyond the original allocation boundary. This leads to heap corruption, which can cause a process crash or potentially allow arbitrary code execution depending on the heap layout and process hardening. **Recommendations** Update FFmpeg to a version later than 8.1.2. As a temporary mitigation, avoid using the `vf floodfill` filter with the `-reinit filter 0` option when processing dynamically sized video streams.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 3.0 through 8.1.2 **Description** An out-of-bounds write exists in the `vf swaprect` video filter. This occurs when the `filter frame()` function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes. When processing a crafted NV12 video frame with odd width dimensions, such as a 17x16 frame, an 18-byte memcpy is performed into a 17-byte heap allocation for the interleaved chroma plane. This leads to heap corruption, which can cause the process to crash or potentially allow for arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.3 **Description** An out-of-bounds write issue exists when processing a crafted ffconcat file using the `-safe 0` flag. The `demux audio()` function within the TY demuxer decrements the packet size without performing bounds checking. This results in a negative size value being passed to the `memcpy()` function inside `shorten decode frame()`. The subsequent conversion to `size t` causes the value to wrap to near `SIZE MAX`, leading to reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer, which causes heap corruption. **Recommendations** Update to a version newer than 8.1.2. Avoid using the `-safe 0` flag when processing ffconcat files.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions 2.7 through 8.1.2 **Description** An out-of-bounds write issue exists in the TDSC video decoder. A remote attacker can cause heap corruption by providing a specially crafted AVI file that alters frame dimensions across TDSF frames. The `tdsc parse tdsf()` function does not unreference the current reference frame before calling `av frame get buffer()`. This leads the `tdsc blit()` and `tdsc yuv2rgb()` functions to write attacker-controlled pixel data beyond the boundaries of the undersized reference frame buffer, which can result in a process crash or potential arbitrary code execution. **Recommendations** Update FFmpeg to a version later than 8.1.2.

**Name of the Vulnerable Software and Affected Versions** com tags (affected versions not specified) **Description** Improperly validated order clauses lead to a SQL injection, which occurs when an attacker can interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** com finder (affected versions not specified) **Description** Improperly built filter clauses lead to a SQL injection in the search query. SQL injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An improper access check allows privilege escalation through the `com users` batch task. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.