CVE-2016-2213
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows...
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
CVE-2016-2213- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
CVE-2016-2213- Updated
- 2026-11-02
EUVDEUVD-2016-3297 No score
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
EUVD-2016-3297- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hpgr-m9m8-mhxq
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows...
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
GHSA-hpgr-m9m8-mhxq- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-2213
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
ALPINE-CVE-2016-2213- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
CVE-2016-2213- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2016-2213
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
DEBIAN-CVE-2016-2213- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2213
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
- Record
UBUNTU-CVE-2016-2213- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0060 No score
Updated ffmpeg packages fix security vulnerabilities
Updated ffmpeg packages fix security vulnerabilities:
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file (CVE-2016-1897).
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file (CVE-2016-1898).
Out-of-array read in FFmpeg before 2.4.13 in jpeg2000_decode_tile() in jpeg2000dec.c (CVE-2016-2213).
- Record
MGASA-2016-0060- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.3 |
before 2.8.11-r0 | 2.8.11-r0 |
ffmpegDebian:12 |
before 7:2.8.6-1 | 7:2.8.6-1 |
ffmpegDebian:13 |
before 7:2.8.6-1 | 7:2.8.6-1 |
ffmpegDebian:14 |
before 7:2.8.6-1 | 7:2.8.6-1 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5 | 2.4.13-1.mga5 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5.tainted | 2.4.13-1.mga5.tainted |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.6-1ubuntu1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 4 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu4 |
7:2.8.6-1ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2213 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published February 3, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in ffmpeg 2.8.11-r0.
References
git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=0aada30510d809bccfd539a90ea37b61188f2cb4
securitytracker.com/id/1034923
security.gentoo.org/glsa/201606-09
nvd.nist.gov/vuln/detail/CVE-2016-2213
github.com/advisories/GHSA-hpgr-m9m8-mhxq
Show 10 moreShow less
security.alpinelinux.org/vuln/CVE-2016-2213
security-tracker.debian.org/tracker/CVE-2016-2213
advisories.mageia.org/MGASA-2016-0060.html
bugs.mageia.org/show_bug.cgi?id=17539
openwall.com/lists/oss-security/2016/02/03/2
ffmpeg.org/download.html
ubuntu.com/security/CVE-2016-2213
cve.org/CVERecord?id=CVE-2016-2213