High severity7.8NVD Advisory· Published Jun 28, 2017· Updated Jun 17, 2026
CVE-2017-9996
CVE-2017-9996
Description
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
35cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*+ 34 more
- cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.10:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.11:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:2.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*
- (no CPE)range: >=2.8 <2.8.12, >=3.0 <3.0.8, >=3.1 <3.1.8, >=3.2 <3.2.5, >=3.3 <3.3.1
Patches
Vulnerability mechanics
References
5- github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660nvdIssue TrackingPatchThird Party Advisory
- github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489dnvdIssue TrackingPatchThird Party Advisory
- www.securityfocus.com/bid/99323nvdThird Party AdvisoryVDB Entry
- bugs.chromium.org/p/oss-fuzz/issues/detailnvdIssue TrackingThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detailnvdIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.