CVE-2018-13305

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.0.1

Description The issue arises from a missing check for negative values of the mquant variable in the vc1 put blocks clamped function, located in libavcodec/vc1 block.c. This can lead to an out-of-array access when converting a crafted AVI file to MPEG4, potentially resulting in information disclosure or a denial of service.

Recommendations For FFmpeg version 4.0.1, consider applying a patch that adds a check for negative mquant values in the vc1 put blocks clamped function to prevent out-of-array access. As a temporary workaround, avoid converting crafted AVI files to MPEG4 until a patch is available.