What’s Vulnerable › Vulnerabilities

CVE-2017-9994

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-28 · updated 2026-06-17
• Weakness: CWE-119

Description

libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.

Affected products

• Debian Linux: 8.0
• FFmpeg: before 2.8.12; from 3.0 before 3.0.8; from 3.1 before 3.1.8; from 3.2 before 3.2.5; from 3.3 before 3.3.1 — fixed in 2.8.12, 3.0.8, 3.1.8, 3.2.5, 3.3.1

How to fix

Upgrade to a fixed version: FFmpeg 2.8.12, 3.0.8, 3.1.8, 3.2.5. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/99317
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1434
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1435
• https://github.com/FFmpeg/FFmpeg/commit/6b5d3fb26fb4be48e4966e4b1d97c2165538d4ef
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
• http://www.securityfocus.com/bid/99317
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1434
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1435
• https://github.com/FFmpeg/FFmpeg/commit/6b5d3fb26fb4be48e4966e4b1d97c2165538d4ef
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html

Get alerted when CVE-2017-9994 or the next vulnerability affects your stack