Email Triage
MCP Workflows
Slack Bot
Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FFmpeg FFmpeg
Default version status: unaffected
0 to < 8.1.3affected9.0 to < 9.0.2affected
pkg:github/ffmpeg/ffmpegReferences
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24432 ↗
- https://github.com/FFmpeg/FFmpeg/commit/e15ddb7f9a2f9b3ab8ac305efb6f94ddc18463d0 ↗
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/apac.c#L146 ↗
- https://github.com/FFmpeg/FFmpeg ↗
- https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-out-of-bounds-write-via-apac-decoder ↗