Medium severity · published Aug 31, 2017
CVE-2017-14057
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption
6.5
CVSS
1.8%
EPSS
No
On KEV
Description
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Ffmpeg · Ffmpeg
3.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14057
www.debian.org
http://www.debian.org/security/2017/dsa-3996
www.securityfocus.com
http://www.securityfocus.com/bid/100630
Patch
https://github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0d7329
lists.debian.org
https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
More from Ffmpeg
9.8
CVE-2026-75143
FFmpeg Heap Buffer Overflow via RIST Protocol Reader
9.8
CVE-2026-40962
FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c
9.8
CVE-2024-35368
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c
9.8
CVE-2024-31581
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c
9.8
CVE-2024-22862
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser