Every CVE Search/ Get API key

CVE-2020-12284

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a heap-based buffer overflow...

9.8 CriticalFix available

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.85%Up 2.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
CVE-2020-12284
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
CVE-2020-12284
Updated
2026-11-02
EUVDEUVD-2020-4596 No score

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
EUVD-2020-4596
Updated
2026-11-03
GitHub AdvisoriesGHSA-qvcx-wpfr-c8wc 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a heap-based buffer overflow...

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
GHSA-qvcx-wpfr-c8wc
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-12284 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
ALPINE-CVE-2020-12284
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
CVE-2020-12284
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
Show 5 moreShow less
OSVDEBIAN-CVE-2020-12284 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
DEBIAN-CVE-2020-12284
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2025-108 9.8

`cbs_jpeg_split_fragment` in `libavcodec/cbs_jpeg.c` in FFmpeg 4.1 and 4.2.2 has a heap-based buffer...

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
JLSEC-2025-108
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12284 9.8

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

Record
UBUNTU-CVE-2020-12284
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0290 No score

Updated ffmpeg packages fix security vulnerability

Updated ffmpeg packages fix security vulnerabilities:

This update provides ffmpeg version 4.1.6, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record
MGASA-2020-0290
Updated
2026-11-02
OSVUSN-4431-1 No score

ffmpeg vulnerabilities

It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to cause a denial of service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as it was already fixed in Ubuntu 18.04 LTS. For more information see: https://usn.ubuntu.com/usn/usn-3967-1 (CVE-2018-15822, CVE-2019-11338)

It was discovered that FFmpeg incorrectly handled sscanf failures. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-12730)

It was discovered that FFmpeg incorrectly handled certain WEBM files. An attacker could possibly use this issue to obtain sensitive data or other unspecified impact. This issue only affected Ubuntu 20.04 LTS. (CVE-2019-13312)

It was discovered that FFmpeg incorrectly handled certain AVI files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-13390)

It was discovered that FFmpeg incorrectly handled certain input. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17539)

It was discovered that FFmpeg incorrectly handled certain input during decoding of VQA files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17542)

It was discovered that FFmpeg incorrectly handled certain JPEG files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-12284)

It was discovered that FFmpeg incorrectly handled certain M3U8 files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. (CVE-2020-13904)

Record
USN-4431-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Alpine:v3.10
 before 4.1.6-r0
4.1.6-r0
ffmpeg
Alpine:v3.11
 before 4.2.4-r0
4.2.4-r0
ffmpeg
Alpine:v3.12
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.13
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.14
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.15
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.16
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.17
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.18
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.19
 before 4.3-r0
4.3-r0
Show 23 moreShow less
Affected packages
PackageAffectedFixed
ffmpeg
Alpine:v3.20
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.21
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.22
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.23
 before 4.3-r0
4.3-r0
ffmpeg
Alpine:v3.24
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.16
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.17
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.18
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.19
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.20
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.21
 before 4.3-r0
4.3-r0
ffmpeg4
Alpine:v3.22
 before 4.3-r0
4.3-r0
ffmpeg
Debian:12
 before 7:4.2.3-1
7:4.2.3-1
ffmpeg
Debian:13
 before 7:4.2.3-1
7:4.2.3-1
ffmpeg
Debian:14
 before 7:4.2.3-1
7:4.2.3-1
ffmpeg
Debian:10
From an advisory covering 7 CVEs
 before 7:4.1.6-1~deb10u1, plus listed versions
7:4.1.3-17:4.1.4-17:4.1.4-1~deb10u1
7:4.1.6-1~deb10u1
FFMPEG_jll
Julia
 before 4.3.1+0
4.3.1+0
ffmpeg
Mageia:7
From an advisory covering 2 CVEs
 before 4.1.6-1.mga7
4.1.6-1.mga7
ffmpeg
Mageia:7
From an advisory covering 2 CVEs
 before 4.1.6-1.mga7.tainted
4.1.6-1.mga7.tainted
ffmpeg
Ubuntu:20.04:LTS
 before 7:4.2.4-1ubuntu0.1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1
7:4.2.4-1ubuntu0.1
ffmpeg
Ubuntu:16.04:LTS
From an advisory covering 9 CVEs
 before 7:2.8.17-0ubuntu0.1, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 11 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1
7:2.8.17-0ubuntu0.1
ffmpeg
Ubuntu:18.04:LTS
From an advisory covering 9 CVEs
 before 7:3.4.8-0ubuntu0.2, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 7 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.1
7:3.4.8-0ubuntu0.2
ffmpeg
Ubuntu:20.04:LTS
From an advisory covering 9 CVEs
 before 7:4.2.4-1ubuntu0.1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1
7:4.2.4-1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12284 is a critical vulnerability (CVSS 9.8) in Ffmpeg, published April 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. Fixed in ffmpeg 4.1.6-r0.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open