Medium severity6.5OSV Advisory· Published Jan 3, 2018· Updated Jun 17, 2026

CVE-2017-1000460

Description

In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/FfmpegOSV3 versions
N, dev14.2, n0.11-dev, …+ 2 more
- (no CPE)range: N, dev14.2, n0.11-dev, …
- cpe:2.3:a:ffmpeg:ffmpeg:3.4:*:*:*:*:*:*:*
- (no CPE)range: <n3.4
Google/Chrome
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Range: <=56.0.2924
Libav/Libav
cpe:2.3:a:libav:libav:13_dev0:*:*:*:*:*:*:*
Libav/libavcodecllm-fuzzy
Chromium/Chromiumllm-fuzzy
Range: <56

Patches

Vulnerability mechanics

References

chromium.googlesource.com/chromium/third_party/ffmpeg/+/8e313ca08800178efce00045e07dc494d437b70cnvdIssue TrackingPatch
lists.ffmpeg.org/pipermail/ffmpeg-cvslog/2017-January/104221.htmlnvdIssue TrackingPatch
bugzilla.libav.org/show_bug.cginvdExploitIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2019/03/msg00041.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000