CVE-2009-4632
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might...
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
Exploit likelihood
What each source reports
NVD Score used
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
CVE-2009-4632- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
CVE-2009-4632- Updated
- 2026-11-02
EUVDEUVD-2009-4597 No score
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
EUVD-2009-4597- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p7gc-v34v-9vc8 No score
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might...
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
GHSA-p7gc-v34v-9vc8- Updated
- 2026-11-02
OSV No score
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
CVE-2009-4632- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4632 No score
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
- Record
DEBIAN-CVE-2009-4632- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 4:0.5+svn20090706-3 | 4:0.5+svn20090706-3 |
ffmpegDebian:13 |
before 4:0.5+svn20090706-3 | 4:0.5+svn20090706-3 |
ffmpegDebian:14 |
before 4:0.5+svn20090706-3 | 4:0.5+svn20090706-3 |
ffmpeg-debianDebian:5.0 From an advisory covering 9 CVEs |
before 0.svn20080206-18+lenny1, plus listed versions 0.svn20080206-160.svn20080206-170.svn20080206-17+lenny10.svn20080206-18 |
0.svn20080206-18+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4632 is a medium vulnerability (CVSS 5.8) in Ffmpeg, published February 10, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in ffmpeg 4:0.5+svn20090706-3.
References
mandriva.com/security/advisories?name=MDVSA-2011:088
secunia.com/advisories/36805
securityfocus.com/bid/36465
roundup.ffmpeg.org/roundup/ffmpeg/issue1240
Show 12 moreShow less
scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html
vupen.com/english/advisories/2011/1241
debian.org/security/2010/dsa-2000
ubuntu.com/usn/USN-931-1
nvd.nist.gov/vuln/detail/CVE-2009-4632
github.com/advisories/GHSA-p7gc-v34v-9vc8
security-tracker.debian.org/tracker/CVE-2009-4632