CVE-2011-3937

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-05 · updated 2026-06-16

Description

The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."

Affected products

FFmpeg: through 0.9.1; 0.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0 (+44)
libav: 0.5, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5 (+18)

References

http://ffmpeg.org/security.html
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba
http://libav.org/news.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:079
http://ffmpeg.org/security.html
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba
http://libav.org/news.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:079

Get alerted when CVE-2011-3937 or the next vulnerability affects your stack