CVE-2016-7785

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers...

5.5 MediumFix available

CVE-2016-7785 is a medium vulnerability (CVSS 5.5) in Ffmpeg, published October 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in ffmpeg 2.8.11-r0.

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.30%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: CVE-2016-7785
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: CVE-2016-7785
Updated: 2026-11-02

EUVDEUVD-2016-8635 No score

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: EUVD-2016-8635
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rx33-q8gm-pjjw 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers...

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: GHSA-rx33-q8gm-pjjw
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVALPINE-CVE-2016-7785 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: ALPINE-CVE-2016-7785
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: CVE-2016-7785
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2016-7785 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: DEBIAN-CVE-2016-7785
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7785 5.5

The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

Record: UBUNTU-CVE-2016-7785
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2018-0008 No score

Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record: MGASA-2018-0008
Updated: 2026-11-02

OSVopenSUSE-SU-2016:2556-1 No score

Security update for ffmpeg

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

CVE-2016-7562: out-of-bounds array write fault via specially crafted avi files
CVE-2016-7502: out-of-bounds array write via incorrect block values
CVE-2016-7905: null-point-exception when decoding avi files with crafted 'gab2' structs
CVE-2016-7555: memory leak when decoding avi files with crafted 'strh' struct
CVE-2016-7785: assert fault via avi files with crafted 'strh' struct

Record: openSUSE-SU-2016:2556-1
Updated: 2026-11-02

OSVopenSUSE-SU-2016:2560-1 No score

Security update for ffmpeg

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

CVE-2016-7562: out-of-bounds array write fault via specially crafted avi files
CVE-2016-7502: out-of-bounds array write via incorrect block values
CVE-2016-7905: null-point-exception when decoding avi files with crafted 'gab2' structs
CVE-2016-7555: memory leak when decoding avi files with crafted 'strh' struct
CVE-2016-7785: assert fault via avi files with crafted 'strh' struct

Record: openSUSE-SU-2016:2560-1
Updated: 2026-11-02

Affected products

ffmpeg

Affected packages

Affected packages
Package	Affected	Fixed
`ffmpeg` Alpine:v3.3	before 2.8.11-r0	2.8.11-r0
`ffmpeg` Alpine:v3.4	before 3.0.7-r0	3.0.7-r0
`ffmpeg` Debian:12	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Debian:13	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Debian:14	before 7:3.1.4-1	7:3.1.4-1
`ffmpeg` Mageia:5	before 2.4.14-1.mga5	2.4.14-1.mga5
`ffmpeg` Mageia:5	before 2.4.14-1.mga5.tainted	2.4.14-1.mga5.tainted
`ffmpeg` Ubuntu:16.04:LTS	before 7:2.8.10-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 7 moreShow less 7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.1	7:2.8.10-0ubuntu0.16.04.1
`ffmpeg` SUSE:Package Hub 12 SP1	before 2.8.8-6.1	2.8.8-6.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less