CVE-2023-49502: fedoraproject fedora Classic Buffer Overflow
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2023-49502DEBIAN-CVE-2023-49502CGA-3xf9-8xw9-67prCGA-6pff-34rj-3cv4CGA-7hq7-jxp9-8ff5CGA-8rxj-vpgc-cg8cCGA-cc39-m4f3-px49CGA-f986-pf8h-96w3CGA-g32m-hmc2-8gq8CGA-rvrf-v8h8-9c99CGA-xfq4-f3w7-849jCGA-xwxf-8gwf-p6hh
Published 19-04-2024Last modified 04-11-2025
Vulnerability summary
CVE-2023-49502 is a high (CVSS 8.8) Classic Buffer Overflow vulnerability in fedoraproject fedora. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
1.53%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 19-04-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.53%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.01 pp
From 1.54% on 19-09-2026
19-09-202619-10-2026
EPSS score1.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (trac.ffmpeg.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard5 products
- ffmpeg-6All versions (No fix recorded)
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Ubuntu2 products
- ffmpeg< 7:3.4.11-0ubuntu0.1+esm5 | < 7:4.2.7-0ubuntu0.1+esm5 | < 7:4.4.2-0ubuntu0.22.04.1+esm4 | < 7:6.1.1-3ubuntu5+esm1
- libavAll versions (No fix recorded)
Debian1 product
- ffmpeg< 7:5.1.7-0+deb12u1 | < 7:7.0.1-3
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Ffmpeg1 product
- ffmpeg≥ 6.1, < 7.0
5 vendors · 10 products
