Input validation error in FFmpeg - CVE-2014-9676
Published: November 30, 2016 / Updated: June 8, 2025
Vulnerability identifier: #VU110591
CSH Severity: Medium
CVSS v4.0:
CVE-ID: CVE-2014-9676
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: ffmpeg.sourceforge.net
Affected software:
FFmpeg
FFmpeg
Detailed vulnerability description
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.
How to mitigate CVE-2014-9676
Install update from vendor's website.