CyberRota Analysis
AI-GeneratedFFmpeg versions 3.4 through 8.1.2 are vulnerable to an out-of-bounds write in the vf_floodfill video filter, which can lead to heap memory corruption when processing dynamically sized video streams with filtergraph reinitialization disabled. This vulnerability may allow attackers to crash the application and potentially execute arbitrary code, depending on the heap layout and process hardening measures in place. Organizations using affected FFmpeg versions, particularly those handling untrusted video streams, should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.
Related CVEs
Other vulnerabilities affecting the same vendor(s)