6.5

CVE-2018-1999013: ffmpeg Use After Free

CVSS: 6.5v3.0MediumModified
AliasesUBUNTU-CVE-2018-1999013DEBIAN-CVE-2018-1999013CGA-632f-cr8v-4c5f
Published 23-07-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-1999013 is a medium (CVSS 6.5) Use After Free vulnerability in ffmpeg. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.0 (NVD)
EPSS score
1.74%
0%100%
Low · -0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DSA-4249-1SUSE-SU-2018:2305-1

Timeline

  1. 23-07-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

1.74%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

-0.03 pp

From 1.77% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
  • torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
  • torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
  • torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Ubuntu4 products
  • chromium-browserAll versions (No fix recorded)
  • gst-libav1.0All versions (No fix recorded)
  • oxide-qtAll versions (No fix recorded)
  • qtwebengine-opensource-srcAll versions (No fix recorded)
Debian1 product
  • ffmpeg< 7:4.0.2-1
Ffmpeg1 product

4 vendors · 10 products

References

5 links