CVE-2009-0385

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-02-02 · updated 2026-06-16

Description

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

Affected products

Canonical Ubuntu Linux: 7.10, 8.04, 8.10
Debian Linux: 4.0, 5.0, 6.0
Fedoraproject Fedora: 9, 10
FFmpeg: before 0.6.3 — fixed in 0.6.3

How to fix

Upgrade to a fixed version: FFmpeg 0.6.3. Check the vendor advisory for mitigations.

References

http://git.ffmpeg.org/?p=ffmpeg%3Ba=commitdiff%3Bh=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17
http://osvdb.org/51643
http://secunia.com/advisories/33711
http://secunia.com/advisories/34296
http://secunia.com/advisories/34385
http://secunia.com/advisories/34712
http://secunia.com/advisories/34845
http://secunia.com/advisories/34905
http://security.gentoo.org/glsa/glsa-200903-33.xml
http://svn.mplayerhq.hu/ffmpeg/trunk/libavformat/4xm.c?r1=16838&r2=16846&pathrev=16846
http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=16846
http://www.debian.org/security/2009/dsa-1781

Get alerted when CVE-2009-0385 or the next vulnerability affects your stack