What’s Vulnerable › Vulnerabilities

CVE-2019-9718

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-12 · updated 2026-06-17
• Weakness: CWE-125

Description

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

Affected products

• Canonical Ubuntu Linux: 18.04, 18.10, 19.04
• Debian Linux: 9.0
• FFmpeg: 3.2, 4.1

References

• http://www.securityfocus.com/bid/107382
• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
• https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21
• https://seclists.org/bugtraq/2019/May/60
• https://usn.ubuntu.com/3967-1/
• https://www.debian.org/security/2019/dsa-4449
• http://www.securityfocus.com/bid/107382
• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
• https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21
• https://seclists.org/bugtraq/2019/May/60
• https://usn.ubuntu.com/3967-1/
• https://www.debian.org/security/2019/dsa-4449

Get alerted when CVE-2019-9718 or the next vulnerability affects your stack