CVE-2023-46407

2023-10-2720:15:09

Google

osv.dev

ffmpeg

out of bounds read

vulnerability

dist->alphabet_size

read_vlc_prefix

software

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.

CPENameOperatorVersion
ffmpeg.giteqn3.1-de
ffmpeg.giteqn2.2-de
ffmpeg.giteqn2.6-de
ffmpeg.giteqn3.5-de
ffmpeg.giteqn5.1-de
ffmpeg.giteqn5.2-de
ffmpeg.giteqn3.4-de
ffmpeg.giteqn2.8-de
ffmpeg.giteqn2.7-de
ffmpeg.giteqn2.5-de

Name	Operator	Version
ffmpeg.git	eq	n3.1-de
ffmpeg.git	eq	n2.2-de
ffmpeg.git	eq	n2.6-de
ffmpeg.git	eq	n3.5-de
ffmpeg.git	eq	n5.1-de
ffmpeg.git	eq	n5.2-de
ffmpeg.git	eq	n3.4-de
ffmpeg.git	eq	n2.8-de
ffmpeg.git	eq	n2.7-de
ffmpeg.git	eq	n2.5-de