CVE-2017-9991: ffmpeg
CVSS: 7.8v3.0HighModified
AliasesALPINE-CVE-2017-9991UBUNTU-CVE-2017-9991DEBIAN-CVE-2017-9991CGA-25fj-m8j5-7284CGA-26qg-fw5j-2xhpCGA-8qr4-qc5v-jcqmCGA-9rqg-vv26-99w8CGA-m976-m299-wvvjCGA-qp48-r64w-g98qCGA-r277-v56f-hfrxCGA-wvr3-pg96-4m5p
Published 28-06-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-9991 is a high (CVSS 7.8) vulnerability in ffmpeg. EPSS estimates a 1.84% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
1.84%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.84%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.84% on 18-09-2026
18-09-202618-10-2026
EPSS score1.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Ubuntu2 products
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
- libavAll versions (No fix recorded)
Alpine1 product
- ffmpeg< 3.1.8-r0 | < 3.2.5-r0
Debian1 product
- ffmpeg< 7:3.2.5-1
Ffmpeg1 product
- ffmpegEOL≤ 2.8.11 | 3.0 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.1 | 3.1.1 | 3.1.2 | 3.1.3 | 3.1.4 | 3.1.5 | 3.1.6 | 3.1.7 | 3.2 | 3.2.1 | 3.2.2 | 3.2.3 | 3.2.4 | 3.3
5 vendors · 9 products
References
7 links- bugs.chromium.org/p/oss-fuzz/issues/detail?id=1399X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
- github.com/FFmpeg/FFmpeg/commit/441026fcb13ac23aa10edc312bdacb6445a0ad06X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORTFIX
