CVE-2011-3504
Description
A memory allocation flaw in FFmpeg's Matroska decoder before 0.8.3 allows remote code execution via a crafted Matroska file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A memory allocation flaw in FFmpeg's Matroska decoder before 0.8.3 allows remote code execution via a crafted Matroska file.
Vulnerability
The Matroska format decoder in FFmpeg versions before 0.8.3 (and Libav in Ubuntu 11.04) does not properly allocate memory when parsing specially crafted Matroska files [1][2][3]. This memory allocation flaw can be triggered by a maliciously crafted file, leading to a buffer overflow or other memory corruption [3].
Exploitation
An attacker must convince a user to open a crafted Matroska file, either as an email attachment or by hosting it on a website [3]. The vulnerability cannot be exploited automatically via email; user interaction is required [3]. No authentication or special network position is needed beyond delivering the file to the victim [3].
Impact
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the application [1][2][3]. If the user has administrative rights, the attacker can gain full control of the system, install programs, view/change/delete data, or create new accounts [3].
Mitigation
The vulnerability is fixed in FFmpeg version 0.8.3 [3]. Ubuntu released updates via USN-1320-1 (FFmpeg) and USN-1333-1 (Libav) in January 2012 [1][2]. Users should upgrade to the patched versions. No workarounds are documented; updating is the recommended mitigation [1][2][3].
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
25cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*+ 24 more
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*range: <=0.8.0
- cpe:2.3:a:ffmpeg:ffmpeg:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.4.9:pre1:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6.2:*:*:*:*:*:*:*
- (no CPE)range: <0.8.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- secunia.com/advisories/45532nvd
- technet.microsoft.com/en-us/security/msvr/msvr11-011nvd
- ubuntu.com/usn/usn-1320-1nvd
- ubuntu.com/usn/usn-1333-1nvd
- www.ffmpeg.org/releases/ffmpeg-0.7.5.changelognvd
- www.ffmpeg.org/releases/ffmpeg-0.8.4.changelognvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.osvdb.org/75621nvd
News mentions
0No linked articles in our index yet.