CVE-2017-14171: ffmpeg Excessive Iteration
Vulnerability summary
CVE-2017-14171 is a high (CVSS 7.1) Excessive Iteration vulnerability in ffmpeg. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 07-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.77%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.77% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- ffmpeg< 3.1.11-r0 | < 3.2.8-r0 | < 3.3.4-r0
Debian1 product
- ffmpeg< 7:3.3.4-1
Ffmpeg1 product
- ffmpegEOL3.3.3
Ubuntu1 product
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
4 vendors · 4 products
References
8 links- github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2453b7X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
