Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

FFmpeg before 1.1 can be crashed by crafted Madcow video

CVE-2013-0851 · published 12 years ago
Summary

The older FFmpeg library (versions before 1.1) can be sent a specially made Electronic Arts Madcow video that makes the program read data outside its expected area. This can cause the software to stop working or behave unpredictably. Upgrade FFmpeg to version 1.1 or newer to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ffmpeg ffmpeg <= 1.0
0.3
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
43 more version ranges
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Original advisory text
The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bo...
The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bounds array access.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published7 Dec 2013
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-0851 · NVD
Track software like this
Free during beta