CVE-2012-2796

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-10 · updated 2026-06-16

Description

Unspecified vulnerability in the vc1_decode_frame function in libavcodec/vc1dec.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to inconsistencies in "coded slice positions and interlacing" that trigger "out of array writes."

Affected products

FFmpeg: through 0.10.4; 0.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0 (+47)
libav: 0.8, 0.8-beta2, 0.8.1, 0.8.2, 0.8.3

References

http://ffmpeg.org/security.html
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5e59a77cec804a9b44c60ea22c17beba6453ef23
http://libav.org/releases/libav-0.8.4.changelog
http://secunia.com/advisories/50468
http://secunia.com/advisories/51257
http://www.mandriva.com/security/advisories?name=MDVSA-2013:079
http://www.openwall.com/lists/oss-security/2012/08/31/3
http://www.openwall.com/lists/oss-security/2012/09/02/4
http://www.securityfocus.com/bid/55355
http://ffmpeg.org/security.html
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5e59a77cec804a9b44c60ea22c17beba6453ef23
http://libav.org/releases/libav-0.8.4.changelog

Get alerted when CVE-2012-2796 or the next vulnerability affects your stack