Every CVE Search/ Get API key

CVE-2018-6621

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote...

6.5 MediumFix available

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.16%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
CVE-2018-6621
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
CVE-2018-6621
Updated
2026-11-02
EUVDEUVD-2018-18368 No score

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
EUVD-2018-18368
Updated
2026-11-03
GitHub AdvisoriesGHSA-338p-29rv-rc6r 6.5

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote...

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
GHSA-338p-29rv-rc6r
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 6.5

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
CVE-2018-6621
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-6621 6.5

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
DEBIAN-CVE-2018-6621
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-6621 6.5

The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

Record
UBUNTU-CVE-2018-6621
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0319 No score

Updated ffmpeg packages fix security vulnerabilities

This update provides ffmpeg version 3.3.8, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record
MGASA-2018-0319
Updated
2026-11-02
OSVopenSUSE-SU-2018:0470-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0470-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0476-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0476-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score

ffmpeg-4-4.4-5.2 on GA media

These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10754-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:12
 before 7:3.4.2-1
7:3.4.2-1
ffmpeg
Debian:13
 before 7:3.4.2-1
7:3.4.2-1
ffmpeg
Debian:14
 before 7:3.4.2-1
7:3.4.2-1
libav
Debian:8
 before 6:11.12-1~deb8u4, plus listed versions
6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.12-1~deb8u36:11.3-1
Show 11 moreShow less
6:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1
6:11.12-1~deb8u4
ffmpeg
Debian:9
 before 7:3.2.11-1~deb9u1, plus listed versions
7:3.2.10-1~deb9u17:3.2.10-1~deb9u1~bpo8+17:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u17:3.2.9-1~deb9u1
7:3.2.11-1~deb9u1
ffmpeg
Mageia:6
 before 3.3.8-1.mga6
3.3.8-1.mga6
ffmpeg
Mageia:6
 before 3.3.8-1.mga6.tainted
3.3.8-1.mga6.tainted
ffmpeg
SUSE:Package Hub 12 SP2
 before 3.4.2-14.1
3.4.2-14.1
ffmpeg-4
openSUSE:Tumbleweed
 before 4.4-5.2
4.4-5.2

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6621 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published February 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in ffmpeg 7:3.4.2-1.

References

Show 62 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open