CVE-2019-12730: ffmpeg Use of Uninitialized Resource
CVSS: 9.8v3.0CriticalModified
AliasesUBUNTU-CVE-2019-12730DEBIAN-CVE-2019-12730DSA-4502-1CGA-4rfr-mv2c-qmrwCGA-5mrm-7gg9-f959CGA-94mp-qv6m-3533CGA-qcch-w537-cw23CGA-qpqj-w2fm-v8c4CGA-r739-j6c9-qc6pCGA-vhc3-f6mm-4r9cCGA-x2x6-9v8h-mf4g
Published 04-06-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12730 is a critical (CVSS 9.8) Use of Uninitialized Resource vulnerability in ffmpeg. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
3.06%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 04-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.06%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
+0.03 pp
From 3.03% on 18-09-2026
18-09-202618-10-2026
EPSS score3.06%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian1 product
- ffmpeg< 7:4.1.4-1 | < 7:4.1.4-1~deb10u1
Ffmpeg1 product
- ffmpeg< 3.2.14
Ubuntu1 product
- ffmpeg< 7:2.8.17-0ubuntu0.1 | < 7:3.4.8-0ubuntu0.2
4 vendors · 7 products
References
13 links- github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014bX Refsource MISCPatchThird Party AdvisoryREPORTFIX
- github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40X Refsource MISCThird Party AdvisoryREPORTAdvisory
- git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2X Refsource CONFIRMWEB
