CyberRota Analysis
AI-GeneratedFFmpeg versions prior to 8.1.2 are vulnerable to an uncontrolled resource consumption issue in the IAMF demuxer, which allows unauthenticated attackers to exploit a crafted input file to trigger excessive memory allocation. This can lead to significant memory exhaustion or out-of-memory (OOM) conditions, potentially disrupting services that rely on FFmpeg for media processing. Organizations using affected FFmpeg versions should prioritize patching to mitigate the risk of denial-of-service attacks.
Original NVD Description
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.
Related CVEs
Other vulnerabilities affecting the same vendor(s)