CVE-2019-11338

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.4 through 4.1.2

Description The issue is related to a null pointer dereference in the FFmpeg multimedia library when it incorrectly detects duplicate slices in a single frame. This can be exploited by a remote attacker using specially crafted HEVC data, potentially leading to a denial of service or other unspecified impacts.

Recommendations For FFmpeg version 3.4, update to a version where this issue is fixed. For FFmpeg version 4.1.2, update to a version where this issue is fixed. As a temporary workaround, consider restricting the use of HEVC data in the affected library until a patch is available.