VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 24, 2015· Updated May 6, 2026

CVE-2015-3417

CVE-2015-3417

Description

Use-after-free in FFmpeg before 2.3.6 via crafted H.264 data in MP4 files allows denial of service or potential code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in FFmpeg before 2.3.6 via crafted H.264 data in MP4 files allows denial of service or potential code execution.

Vulnerability

Use-after-free vulnerability in ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6. The bug occurs when freeing H.264 context tables; after freeing, the delayed_pic array is not cleared, leading to a use-after-free condition. Triggered by crafted H.264 data in an MP4 file. [1][3]

Exploitation

An attacker can exploit this by crafting an MP4 file containing malicious H.264 data. The victim must open the file with an application linked to FFmpeg (e.g., browser `` element). No authentication required; remote exploitation possible. The vulnerability is triggered during deallocation when processing the crafted input. [1][2]

Impact

Successful exploitation can cause a denial of service (application crash) or possibly arbitrary code execution with the privileges of the application. The exact impact may vary depending on memory layout and protections. [1][2]

Mitigation

Fixed in FFmpeg version 2.3.6 via commit e8714f6. Users should upgrade to FFmpeg 2.3.6 or later. For systems using libav, upgrade to version 11.8 or later as per Gentoo GLSA 201705-08. No known workaround. [2][3]

References
  1. several issues in SQLite (+ catching up on several other bugs)
  2. Multiple vulnerabilities (GLSA 201705-08) — Gentoo security
  3. avcodec/h264: Clear delayed_pic on deallocation · FFmpeg/FFmpeg@e8714f6

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

4

Patches

1
e8714f6f93d1

avcodec/h264: Clear delayed_pic on deallocation

https://github.com/FFmpeg/FFmpegMichael NiedermayerDec 17, 2014via body-scan
commit
1 file changed · +1 −0
  • libavcodec/h264.c+1 −0 modified
    @@ -391,6 +391,7 @@ void ff_h264_free_tables(H264Context *h, int free_rbsp)
     if (free_rbsp && h->DPB) {
         for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)
             ff_h264_unref_picture(h, &h->DPB[i]);
+        memset(h->delayed_pic, 0, sizeof(h->delayed_pic));
         av_freep(&h->DPB);
     } else if (h->DPB) {
         for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

7

News mentions

0

No linked articles in our index yet.