CVE-2005-4048

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-07 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.

Affected products

FFmpeg: 0.4.6, 0.4.7, 0.4.8, 0.4.9, cvs

References

http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558
http://cvs.freedesktop.org/gstreamer/gst-ffmpeg/ChangeLog?rev=1.239&view=markup
http://secunia.com/advisories/17892
http://secunia.com/advisories/18066
http://secunia.com/advisories/18087
http://secunia.com/advisories/18107
http://secunia.com/advisories/18400
http://secunia.com/advisories/18739
http://secunia.com/advisories/18746
http://secunia.com/advisories/19114
http://secunia.com/advisories/19192
http://secunia.com/advisories/19272

Get alerted when CVE-2005-4048 or the next vulnerability affects your stack