Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

FFmpeg/Libav H.263 decoder mishandles size changes

CVE-2011-3937 · published 13 years ago
Summary

The video decoding component for H.263 in older versions of FFmpeg and Libav may not handle changes in video width or height correctly when using multiple processing threads. This can cause the application to crash or behave unexpectedly when playing certain video files. Updating to the latest version of FFmpeg or Libav resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
libav libav 0.7.3
0.7.4
0.8
0.5
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
9 more version ranges
cpe:2.3:a:libav:libav:0.7.3:*:*:*:*:*:*:*
ffmpeg ffmpeg <= 0.9.1
0.3
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
38 more version ranges
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Original advisory text
The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0....
The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
2% chance of attack within 30 days
Timeline
Published5 Jan 2013
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2011-3937 · NVD
Track software like this
Free during beta