CVE-2017-14057: ffmpeg Excessive Iteration
Vulnerability summary
CVE-2017-14057 is a high (CVSS 7.1) Excessive Iteration vulnerability in ffmpeg. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 31-08-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.81%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.81% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- ffmpeg< 3.1.11-r0 | < 3.2.8-r0 | < 3.3.4-r0
Debian1 product
- ffmpeg< 7:3.3.4-1
Ffmpeg1 product
- ffmpegEOL3.3.3
Ubuntu1 product
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
4 vendors · 4 products
References
8 links
- github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0d7329X Refsource CONFIRMPatchThird Party Advisory