CVE-2015-6826
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not...
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
Exploit likelihood
What each source reports
NVD Score used
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
CVE-2015-6826- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
CVE-2015-6826- Updated
- 2026-11-02
EUVDEUVD-2015-6763 No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
EUVD-2015-6763- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8g9-9wx4-2qmr No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not...
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
GHSA-p8g9-9wx4-2qmr- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
CVE-2015-6826- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-6826 No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
DEBIAN-CVE-2015-6826- Updated
- 2026-11-02
OSVMGASA-2016-0018 No score
Updated ffmpeg packages fix security vulnerabilities
The update_dimensions function in libavcodec/vp8.c in FFmpeg before 2.4.12, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file (CVE-2015-6761).
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.4.11 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks (CVE-2015-6818).
The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.4.11 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data (CVE-2015-6820).
The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.4.11 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data (CVE-2015-6821).
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.4.11 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data (CVE-2015-6822).
The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.4.11 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data (CVE-2015-6823).
The sws_init_context function in libswscale/utils.c in FFmpeg before 2.4.11 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data (CVE-2015-6824).
The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.4.11 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file (CVE-2015-6825).
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.4.11 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted RV30 or RV40 RealVideo data (CVE-2015-6826).
The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.4.12 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data (CVE-2015-8216).
The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.4.12 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data (CVE-2015-8219).
The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.4.12 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers…
- Record
MGASA-2016-0018- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-6826 No score
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
- Record
UBUNTU-CVE-2015-6826- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:2.7.2-1 | 7:2.7.2-1 |
ffmpegDebian:13 |
before 7:2.7.2-1 | 7:2.7.2-1 |
ffmpegDebian:14 |
before 7:2.7.2-1 | 7:2.7.2-1 |
libavDebian:8 From an advisory covering 17 CVEs |
before 6:11.12-1~deb8u2, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.3-16:11.3-1+deb8u16:11.3-2 Show 9 moreShow less6:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u2 |
ffmpegMageia:5 From an advisory covering 17 CVEs |
before 2.4.12-1.mga5 | 2.4.12-1.mga5 |
ffmpegMageia:5 From an advisory covering 17 CVEs |
before 2.4.12-1.mga5.tainted | 2.4.12-1.mga5.tainted |
libavUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6826 is a high vulnerability (CVSS 7.5) in Ffmpeg, published September 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in ffmpeg 7:2.7.2-1.
References
git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a
ubuntu.com/usn/USN-2944-1
lists.debian.org/debian-lts-announce/2018/12/msg00009.html
securitytracker.com/id/1033483
ffmpeg.org/security.html
nvd.nist.gov/vuln/detail/CVE-2015-6826
Show 10 moreShow less
github.com/advisories/GHSA-p8g9-9wx4-2qmr
security-tracker.debian.org/tracker/CVE-2015-6826
advisories.mageia.org/MGASA-2016-0018.html
bugs.mageia.org/show_bug.cgi?id=17257
ubuntu.com/security/CVE-2015-6826
cve.org/CVERecord?id=CVE-2015-6826
Left out here: the rest of 1 source description. The JSON record has them.