Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-0873: FFmpeg can be disrupted by malformed video header

CVE-2013-0873 · published 12 years ago

Summary

FFmpeg versions before 1.1.3 mishandle certain video files, allowing a crafted file to cause the program to free the wrong memory. This can lead to a crash or allow an attacker to run code on the server processing the video. Update FFmpeg to version 1.1.3 or later, or avoid processing untrusted video files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ffmpeg	ffmpeg	<= 1.1.2 0.3 0.3.1 0.3.2 0.3.3 0.3.4 0.4.0 0.4.2 0.4.3 0.4.4 0.4.5 0.4.6 46 more version ranges `cpe:2.3:a:ffmpeg:ffmpeg::::::::`

Original advisory text

The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published23 Nov 2013

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2013-0873 · NVD

Track software like this

Free during beta