CVE-2018-1999015: ffmpeg Out-of-bounds Read
Vulnerability summary
CVE-2018-1999015 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in ffmpeg. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.
Timeline
- 23-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.74%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
-0.02 pp
From 1.76% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian1 product
- ffmpeg< 7:4.0.2-1
Ffmpeg1 product
- ffmpeg≤ 4.0.1
Ubuntu1 product
- gst-libav1.0All versions (No fix recorded)
4 vendors · 7 products
References
5 links- github.com/FFmpeg/FFmpeg/commit/5aba5b89d0b1d73164d3b81764828bb8b20ff32aX Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORTFIX
