Stack-based buffer overflow in FFmpeg - CVE-2008-3162

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the str_read_packet function in libavformat/psxstr.c when processing a crafted STR file that interleaves audio and video sectors. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2008-3162

Links to Public Exploits and PoC-codes

• Exploit #11591 - FFmpeg libavformat - 'psxstr.c' STR Data Heap Based Buffer Overflow (June 12, 2025)

External References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489965
• http://secunia.com/advisories/30994
• http://secunia.com/advisories/31268
• http://secunia.com/advisories/34385
• http://secunia.com/advisories/34905
• http://security.gentoo.org/glsa/glsa-200903-33.xml
• http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=13993
• http://www.debian.org/security/2009/dsa-1781
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:157
• http://www.openwall.com/lists/oss-security/2008/07/09/9
• http://www.openwall.com/lists/oss-security/2008/07/16/4
• http://www.securityfocus.com/bid/30154
• http://www.ubuntu.com/usn/usn-630-1
• http://www.vupen.com/english/advisories/2008/2031/references
• https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311

Related Security Bulletins

• Multiple vulnerabilities in FFmpeg
• Ubuntu update for ffmpeg