Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

libav 9.21 video handling can crash or leak data

CVE-2017-7206 · published 9 years ago
Summary

The libav 9.21 library that processes H.264 video files can be tricked by a specially crafted video to read beyond its memory buffer. This may cause the application to stop working or expose information stored in its memory. Apply the latest libav update or replace the library with a patched version to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
libav libav 9.21
cpe:2.3:a:libav:libav:9.21:*:*:*:*:*:*:*
Original advisory text
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory...
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.1 High
Exploitation
1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Mar 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-7206 · NVD
Track software like this
Free during beta