CVE-2017-14055
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of...
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14055- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-834
- Updated
- 2026-11-02
CVE List No score
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14055- Updated
- 2026-11-02
EUVDEUVD-2017-5569 No score
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
EUVD-2017-5569- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9hp4-rpgx-8fxp
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of...
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
GHSA-9hp4-rpgx-8fxp- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-834
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-14055
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
ALPINE-CVE-2017-14055- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14055- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2017-14055
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
DEBIAN-CVE-2017-14055- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-14055
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
UBUNTU-CVE-2017-14055- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0008 No score
Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2018-0008- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score
ffmpeg-4-4.4-5.2 on GA media
These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10754-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.4 |
before 3.1.11-r0 | 3.1.11-r0 |
ffmpegAlpine:v3.5 |
before 3.1.11-r0 | 3.1.11-r0 |
ffmpegAlpine:v3.6 |
before 3.2.8-r0 | 3.2.8-r0 |
ffmpegAlpine:v3.7 |
before 3.3.4-r0 | 3.3.4-r0 |
ffmpegDebian:12 |
before 7:3.3.4-1 | 7:3.3.4-1 |
ffmpegDebian:13 |
before 7:3.3.4-1 | 7:3.3.4-1 |
ffmpegDebian:14 |
before 7:3.3.4-1 | 7:3.3.4-1 |
libavDebian:8 |
before 6:11.12-1~deb8u4, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.12-1~deb8u36:11.3-1 Show 11 moreShow less6:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u4 |
ffmpegDebian:9 |
before 7:3.2.8-1~deb9u1, plus listed versions 7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u1 |
7:3.2.8-1~deb9u1 |
ffmpegMageia:5 |
before 2.4.14-1.mga5 | 2.4.14-1.mga5 |
ffmpegMageia:5 |
before 2.4.14-1.mga5.tainted | 2.4.14-1.mga5.tainted |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.14-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 9 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.1 |
7:2.8.14-0ubuntu0.16.04.1 |
ffmpeg-4openSUSE:Tumbleweed |
before 4.4-5.2 | 4.4-5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14055 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published August 31, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in ffmpeg 3.1.11-r0.
References
securityfocus.com/bid/100626
github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d714f1e
lists.debian.org/debian-lts-announce/2019/01/msg00006.html
debian.org/security/2017/dsa-3996
nvd.nist.gov/vuln/detail/CVE-2017-14055
Show 52 moreShow less
security.alpinelinux.org/vuln/CVE-2017-14055
security-tracker.debian.org/tracker/CVE-2017-14055
advisories.mageia.org/MGASA-2018-0008.html
bugs.mageia.org/show_bug.cgi?id=20757
ubuntu.com/security/CVE-2017-14055
cve.org/CVERecord?id=CVE-2017-14055
suse.com/security/cve/CVE-2015-8216