Seung Min Shin

**Name of the Vulnerable Software and Affected Versions** FFmpeg (affected versions not specified) **Description** A flaw exists in the `tdsc load cursor()` function that allows writing beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker can exploit this by providing a specially crafted video file, which may result in a denial of service or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FFmpeg (affected versions not specified) **Description** A use-after-free issue exists in the RASC video decoder. The `decode move()` function initializes a read pointer into a decompressed buffer; however, a subsequent reallocation of that buffer during move-table processing results in a dangling pointer. An attacker can trigger this by providing a specially crafted AVI file containing a malicious RASC video stream, causing the decoder to read from freed heap memory, which may lead to a denial of service (crash). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GStreamer (affected versions not specified) **Description** A flaw exists in the WavPack audio decoder within gst-plugins-good. An integer overflow occurs during the buffer size calculation (4 * block samples * channels) inside the `gst wavpack dec handle frame()` function when processing a specially crafted WavPack file. This results in an undersized heap allocation, allowing the WavPack library to write decoded audio samples beyond the allocated buffer, leading to heap memory corruption. This issue impacts both 32-bit and 64-bit systems because the arithmetic is performed using 32-bit integers before being promoted to the allocation size type. A remote attacker could exploit this to crash an application or potentially execute arbitrary code if a user is convinced to open a malicious WavPack audio file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.