FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding…
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- FFmpeg
- Product
- FFmpeg
- CVSS v3.1
- 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weakness
- CWE-908
- NVD status
- Received
Why it ranks 18 (Routine)
- CVSS v3.1 5.5 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.