CVE-2011-3945

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-20 · updated 2026-06-16
Weakness: CWE-119

Description

The decode_frame function in the KVG1 decoder (kgv1dec.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted media file.

Affected products

FFmpeg: 0.7, 0.7.1, 0.7.2, 0.7.3, 0.7.6, 0.7.7 (+11)
libav: 0.5, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5 (+17)

References

http://ffmpeg.org/
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=a02e8df973f5478ec82f4c507f5b5b191a5ecb6b
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=807a045ab7f51993a2c1b3116016cbbd4f3d20d6
http://libav.org/
http://www.mandriva.com/security/advisories?name=MDVSA-2012:076
http://ffmpeg.org/
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=a02e8df973f5478ec82f4c507f5b5b191a5ecb6b
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=807a045ab7f51993a2c1b3116016cbbd4f3d20d6
http://libav.org/
http://www.mandriva.com/security/advisories?name=MDVSA-2012:076

Get alerted when CVE-2011-3945 or the next vulnerability affects your stack