CVE-2018-13304
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context...
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
CVE-2018-13304- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
CVE-2018-13304- Updated
- 2026-11-02
EUVDEUVD-2018-5252 No score
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
EUVD-2018-5252- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gqhv-6fqp-j722
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context...
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
GHSA-gqhv-6fqp-j722- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
CVE-2018-13304- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2018-13304
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
DEBIAN-CVE-2018-13304- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-13304
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
- Record
UBUNTU-CVE-2018-13304- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:4.0.2-1 | 7:4.0.2-1 |
ffmpegDebian:13 |
before 7:4.0.2-1 | 7:4.0.2-1 |
ffmpegDebian:14 |
before 7:4.0.2-1 | 7:4.0.2-1 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
dvbcutUbuntu:16.04:LTS |
All versions, plus listed versions 0.5.4+svn178-110.5.4+svn178-12 |
None known |
gst-libav1.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.6.0-21.6.1-11.6.2-11.7.1-1 Show 7 moreShow less1.7.2-11.7.90-11.8.0-11.8.1-1~ubuntu11.8.2-1~ubuntu11.8.3-1ubuntu0.11.8.3-1ubuntu0.2 |
None known |
kinoUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.4-2.1build2 |
None known |
mythtvUbuntu:16.04:LTS |
All versions, plus listed versions 2:0.27.1+fixes.20140624.aa822f5-0ubuntu62:0.27.1+fixes.20140624.aa822f5-0ubuntu72:0.27.1+fixes.20140624.aa822f5-0ubuntu92:0.28.0+fixes.20160217.44fd8a6-0ubuntu42:0.28.0+fixes.20160229.ae35a28-0ubuntu1 Show 6 moreShow less2:0.28.0+fixes.20160321.39e409d-0ubuntu12:0.28.0+fixes.20160321.39e409d-0ubuntu22:0.28.0+fixes.20160325.2520617-0ubuntu32:0.28.0+fixes.20160413.15cf421-0ubuntu12:0.28.0+fixes.20160413.15cf421-0ubuntu22:0.28.0+fixes.20160413.15cf421-0ubuntu2.16.04.1 |
None known |
dvbcutUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.1-10.7.2-1 |
None known |
gst-libav1.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1.12.2-11.12.3-11.12.4-11.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-0ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
None known |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kinoUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.4-2.31.3.4-2.4 |
None known |
mythtvUbuntu:18.04:LTS |
All versions, plus listed versions 2:29.0+fixes.20170728.696806310a-0ubuntu12:29.0+fixes.20170728.696806310a-0ubuntu32:29.0+fixes.20170728.696806310a-0ubuntu42:29.0+fixes.20170728.696806310a-0ubuntu52:29.0+fixes.20170728.696806310a-0ubuntu6 Show 5 moreShow less2:29.0+fixes.20170728.696806310a-0ubuntu72:29.0+fixes.20170728.696806310a-0ubuntu82:29.1+fixes.20180220.9b7b962-0ubuntu22:29.1+fixes.20180220.9b7b962-0ubuntu32:29.1+fixes.20180414.329c235-0ubuntu3 |
None known |
dvbcutUbuntu:20.04:LTS |
All versions, plus listed versions 0.7.3-10.7.3-1build1 |
None known |
gst-libav1.0Ubuntu:20.04:LTS |
All versions, plus listed versions 1.16.1-11.16.2-11.16.2-2 |
None known |
kinoUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.4+dfsg0-11.3.4+dfsg0-1build1 |
None known |
mythtvUbuntu:20.04:LTS |
All versions, plus listed versions 2:30.0+fixes.20190817.5cde0578d8-0ubuntu12:30.0+fixes.20190817.5cde0578d8-0ubuntu22:30.0+fixes.20190817.5cde0578d8-0ubuntu32:31.0+fixes.20200207.35cb9ed0c5-0ubuntu22:31.0+fixes.20200323.9579662cdc-0ubuntu1 |
None known |
chromium-browserUbuntu:22.04:LTS |
All versions, plus listed versions 1:85.0.4183.83-0ubuntu21:85.0.4183.83-0ubuntu2.22.04.1 |
None known |
dvbcutUbuntu:22.04:LTS |
All versions, plus listed versions 0.7.3-1build1 |
None known |
gst-libav1.0Ubuntu:22.04:LTS |
All versions, plus listed versions 1.18.5-11.20.0-11.20.1-11.20.3-0ubuntu1 |
None known |
kinoUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.4+dfsg0-1build21.3.4+dfsg0-1.1 |
None known |
mythtvUbuntu:22.04:LTS |
All versions, plus listed versions 2:31.0+fixes.20200323.9579662cdc-0ubuntu92:31.0+fixes.20200323.9579662cdc-0ubuntu112:32.0+fixes.20220224.56275b303b-0ubuntu32:32.0+fixes.20220224.56275b303b-0ubuntu52:32.0+fixes.20220325.f69ce764b7-0ubuntu1 |
None known |
chromium-browserUbuntu:24.04:LTS |
All versions, plus listed versions 1:85.0.4183.83-0ubuntu32:1snap1-0ubuntu12:1snap1-0ubuntu2 |
None known |
dvbcutUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.4-1build20.7.4-1build30.7.4-1build4 |
None known |
gst-libav1.0Ubuntu:24.04:LTS |
All versions, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
None known |
mythtvUbuntu:24.04:LTS |
All versions, plus listed versions 2:33.0+fixes.20230210.026e506-0ubuntu02:33.0+fixes.20230210.026e506-0ubuntu22:33.0+fixes.20230210.026e506-0ubuntu32:33.0+fixes.20230210.026e506-0ubuntu42:33.0+fixes.20230210.026e506-0ubuntu5 Show 4 moreShow less2:34.0+fixes.20240210.e3e165a1-0ubuntu12:34.0+fixes.20240210.e3e165a1-0ubuntu42:34.0+fixes.20240210.e3e165a1-0ubuntu52:34.0+fixes.20240210.e3e165a1-0ubuntu6 |
None known |
chromium-browserUbuntu:25.10 |
All versions, plus listed versions 2:1snap1-0ubuntu3 |
None known |
dvbcutUbuntu:25.10 |
All versions, plus listed versions 0.7.4-1ubuntu1 |
None known |
gst-libav1.0Ubuntu:25.10 |
All versions, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.3-11.26.4-11.26.5-11.26.6-1 |
None known |
mythtvUbuntu:25.10 |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu32:35.0+fixes.20250302.f3f012aa3f-0ubuntu4 |
None known |
chromium-browserUbuntu:26.10 |
All versions, plus listed versions 2:1snap1-0ubuntu4 |
None known |
gst-libav1.0Ubuntu:26.10 |
All versions, plus listed versions 1.28.2-11.28.3-11.28.4-1build11.28.5-11.28.6-11.28.7-1 |
None known |
mythtvUbuntu:26.10 |
All versions, plus listed versions 2:36.0+fixes.20260401.1385cbfc60-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu3 |
None known |
chromium-browserUbuntu:26.04:LTS |
All versions, plus listed versions 2:1snap1-0ubuntu32:1snap1-0ubuntu4 |
None known |
gst-libav1.0Ubuntu:26.04:LTS |
All versions, plus listed versions 1.26.6-11.27.2-11.27.2-1build11.27.90-11.28.0-11.28.1-11.28.2-1 |
None known |
mythtvUbuntu:26.04:LTS |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu42:35.0+fixes.20250302.f3f012aa3f-0ubuntu52:35.0+fixes.20250302.f3f012aa3f-0ubuntu62:35.0+fixes.20250302.f3f012aa3f-0ubuntu72:36.0+fixes.20260210.a312d68f-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-13304 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published July 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in ffmpeg 7:4.0.2-1.