CVE-2009-4635: ffmpeg Code Injection

Vulnerability summary

CVE-2009-4635 is a high (CVSS 9.3) Code Injection vulnerability in ffmpeg. EPSS estimates a 8.06% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-02-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.