Executive brief
A vulnerability in the FFmpeg multimedia framework could allow an attacker to crash applications that use it to process video files. FFmpeg is a widely used library for handling video, audio, and other multimedia files and streams. By providing a specially crafted media file, an attacker can cause the software to stop responding, leading to a service outage or application failure.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in FFmpeg v8.0.1 within the read_global_param() function located in libavcodec/av1dec.c. The flaw is triggered during the parsing of AV1 encoded content. A remote, unauthenticated attacker can exploit this by providing a specially crafted input file or stream that causes the decoder to read memory outside of the intended buffer. This memory access violation typically results in an immediate crash of the process, leading to a denial of service. The vulnerability is reachable over the network if the application processes untrusted multimedia content.
Affected products
- FFmpeg FFmpeg 8.0.1
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory