Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

FFmpeg may crash when processing malicious video files

CVE-2014-8546 · published 12 years ago
Summary

Versions of the FFmpeg multimedia library older than 2.4.2 mishandle specially crafted Cinepak video data, which can cause the program to stop working. This could interrupt services that rely on FFmpeg for video processing. Updating FFmpeg to version 2.4.2 or newer resolves the issue.

What to do
  • Update debian ffmpeg to version 7:2.4.3-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian ffmpeg < 7:2.4.3-1
Fix: upgrade to 7:2.4.3-1
Debian:12 debian ffmpeg < 7:2.4.3-1
Fix: upgrade to 7:2.4.3-1
Debian:13 debian ffmpeg < 7:2.4.3-1
Fix: upgrade to 7:2.4.3-1
Debian:14 debian ffmpeg < 7:2.4.3-1
Fix: upgrade to 7:2.4.3-1
– ffmpeg ffmpeg <= 2.4.1
0.3
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
93 more version ranges
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Original advisory text
Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Ci...
Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.
References
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published5 Nov 2014
Updated31 Oct 2026
First seen27 Aug 2026
Sources
DEBIAN-CVE-2014-8546 · OSV
CVE-2014-8546 · NVD
Track software like this
Free during beta