CVE-2019-12730

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.14 FFmpeg versions 4.x prior to 4.1.4

Description The issue is related to the lack of error checking in the sscanf function in the libavformat library of the FFmpeg multimedia environment. This can lead to the use of uninitialized variables. Exploitation of this issue may allow a remote attacker to compromise data integrity, gain unauthorized access to protected information, and cause a denial of service.

Recommendations For FFmpeg versions prior to 3.2.14, update to version 3.2.14 or later. For FFmpeg versions 4.x prior to 4.1.4, update to version 4.1.4 or later. As a temporary workaround, consider restricting access to the aa read header function in libavformat/aadec.c until a patch is available.