Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-18775: In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.
CVE-2020-18775 · published 5 years ago
Summary
In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| libav | libav |
12.3 cpe:2.3:a:libav:libav:12.3:*:*:*:*:*:*:* |
Original advisory text
In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.
In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.
References
- https://bugzilla.libav.org/show_bug.cgi?id=1152 Broken Link Exploit Issue Tracking Third Party Advisory
- https://cwe.mitre.org/data/definitions/126.html Technical Description
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published23 Aug 2021
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-18775 · NVD
Track software like this
Free during beta