CVE-2016-7502

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to...

7.8 HighFix available

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.38%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: CVE-2016-7502
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: CVE-2016-7502
Updated: 2026-11-02

EUVDEUVD-2016-8355 No score

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: EUVD-2016-8355
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v4f4-cvgv-7g4f 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to...

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: GHSA-v4f4-cvgv-7g4f
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVALPINE-CVE-2016-7502 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: ALPINE-CVE-2016-7502
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: CVE-2016-7502
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2016-7502 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: DEBIAN-CVE-2016-7502
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7502 7.8

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

Record: UBUNTU-CVE-2016-7502
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0008 No score

Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record: MGASA-2018-0008
Updated: 2026-11-02

OSVopenSUSE-SU-2016:2556-1 No score

Security update for ffmpeg

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

CVE-2016-7562: out-of-bounds array write fault via specially crafted avi files
CVE-2016-7502: out-of-bounds array write via incorrect block values
CVE-2016-7905: null-point-exception when decoding avi files with crafted 'gab2' structs
CVE-2016-7555: memory leak when decoding avi files with crafted 'strh' struct
CVE-2016-7785: assert fault via avi files with crafted 'strh' struct

Record: openSUSE-SU-2016:2556-1
Updated: 2026-11-02

OSVopenSUSE-SU-2016:2560-1 No score

Security update for ffmpeg

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

CVE-2016-7562: out-of-bounds array write fault via specially crafted avi files
CVE-2016-7502: out-of-bounds array write via incorrect block values
CVE-2016-7905: null-point-exception when decoding avi files with crafted 'gab2' structs
CVE-2016-7555: memory leak when decoding avi files with crafted 'strh' struct
CVE-2016-7785: assert fault via avi files with crafted 'strh' struct

Record: openSUSE-SU-2016:2560-1
Updated: 2026-11-02

Affected products

ffmpeg

Affected packages

Affected packages
Package	Affected	Fixed
`ffmpeg` Alpine:v3.3	before 2.8.11-r0	2.8.11-r0
`ffmpeg` Alpine:v3.4	before 3.0.7-r0	3.0.7-r0
`ffmpeg` Debian:12	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Debian:13	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Debian:14	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Mageia:5	before 2.4.14-1.mga5	2.4.14-1.mga5
`ffmpeg` Mageia:5	before 2.4.14-1.mga5.tainted	2.4.14-1.mga5.tainted
`ffmpeg` Ubuntu:16.04:LTS	before 7:2.8.10-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 7 moreShow less 7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.1	7:2.8.10-0ubuntu0.16.04.1
`ffmpeg` SUSE:Package Hub 12 SP1	before 2.8.8-6.1	2.8.8-6.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-7502 is a high vulnerability (CVSS 7.8) in Ffmpeg, published October 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in ffmpeg 2.8.11-r0.

References

Show 12 moreShow less