High severity8.8NVD Advisory· Published Sep 27, 2017· Updated Jun 17, 2026

CVE-2017-14767

Description

The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpeg2 versions
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*range: <=3.3.3
- (no CPE)range: <3.3.4

Patches

Vulnerability mechanics

References

github.com/FFmpeg/FFmpeg/commit/c42a1388a6d1bfd8001bf6a4241d8ca27e49326dnvdIssue TrackingPatchThird Party Advisory
www.securityfocus.com/bid/101019nvdThird Party AdvisoryVDB Entry
www.debian.org/security/2017/dsa-3996nvd
lists.debian.org/debian-lts-announce/2019/01/msg00006.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000