Medium severity6.5NVD Advisory· Published Sep 9, 2017· Updated Jun 17, 2026

CVE-2017-14223

Description

In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpeg2 versions
cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*
- (no CPE)range: = 3.3.3
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords
pkg:rpm/opensuse/ffmpeg-4&distro=openSUSE%20Tumbleweed
Range: < 4.4-5.2

Patches

Vulnerability mechanics

References

github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97nvdIssue TrackingPatchThird Party Advisory
www.debian.org/security/2017/dsa-3996nvdThird Party Advisory
www.securityfocus.com/bid/100703nvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000