Email Triage
MCP Workflows
Slack Bot
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FFmpeg FFmpeg
Default version status: unaffected
0 to < 8.1.3affected9.0 to < 9.0.2affected
pkg:github/ffmpeg/ffmpegReferences
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24487 ↗
- https://github.com/FFmpeg/FFmpeg/commit/f8c4c6400e835bf65e8b9cc12aba9e5c4d1c818c ↗
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/hap.c#L33 ↗
- https://github.com/FFmpeg/FFmpeg ↗
- https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-null-pointer-dereference-via-ff-hap-set-chunk-count ↗