CVE-2019-13390
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. This...
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
CVE-2019-13390- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
CVE List No score
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
CVE-2019-13390- Updated
- 2026-11-02
EUVDEUVD-2019-4884 No score
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
EUVD-2019-4884- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gmr-mpx2-2vqh No score
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. This...
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. This may be related to two NULL pointers passed as arguments at libavcodec/frame_thread_encoder.c.
- Record
GHSA-5gmr-mpx2-2vqh- Updated
- 2026-11-02
OSVALPINE-CVE-2019-13390
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
ALPINE-CVE-2019-13390- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
CVE-2019-13390- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2019-13390
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
DEBIAN-CVE-2019-13390- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13390
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
- Record
UBUNTU-CVE-2019-13390- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2023:0206-1 No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
- CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream (bsc#1206778).
- CVE-2019-13390: Fixed a potential crash when processing a crafted AVI stream (bsc#1140754).
- Record
SUSE-SU-2023:0206-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2115-1 No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
- CVE-2019-13390: Fixed a potential crash when processing a crafted AVI stream (bsc#1140754).
- CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream (bsc#1206778).
- CVE-2022-48434: Fixed use after free in libavcodec/pthread_frame.c (bsc#1209934).
- Record
SUSE-SU-2023:2115-1- Updated
- 2026-11-02
OSVUSN-4431-1 No score
ffmpeg vulnerabilities
It was discovered that FFmpeg incorrectly verified empty audio packets or HEVC data. An attacker could possibly use this issue to cause a denial of service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as it was already fixed in Ubuntu 18.04 LTS. For more information see: https://usn.ubuntu.com/usn/usn-3967-1 (CVE-2018-15822, CVE-2019-11338)
It was discovered that FFmpeg incorrectly handled sscanf failures. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-12730)
It was discovered that FFmpeg incorrectly handled certain WEBM files. An attacker could possibly use this issue to obtain sensitive data or other unspecified impact. This issue only affected Ubuntu 20.04 LTS. (CVE-2019-13312)
It was discovered that FFmpeg incorrectly handled certain AVI files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-13390)
It was discovered that FFmpeg incorrectly handled certain input. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17539)
It was discovered that FFmpeg incorrectly handled certain input during decoding of VQA files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17542)
It was discovered that FFmpeg incorrectly handled certain JPEG files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-12284)
It was discovered that FFmpeg incorrectly handled certain M3U8 files. An attacker could possibly use this issue to obtain sensitive information or other unspecified impact. (CVE-2020-13904)
- Record
USN-4431-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.9 |
before 4.0.6-r0 | 4.0.6-r0 |
ffmpegDebian:12 |
before 7:4.2.1-1 | 7:4.2.1-1 |
ffmpegDebian:13 |
before 7:4.2.1-1 | 7:4.2.1-1 |
ffmpegDebian:14 |
before 7:4.2.1-1 | 7:4.2.1-1 |
ffmpegDebian:9 |
before 7:3.2.15-0+deb9u1, plus listed versions 7:3.2.10-1~deb9u17:3.2.10-1~deb9u1~bpo8+17:3.2.11-1~deb9u17:3.2.12-1~deb9u17:3.2.14-1~deb9u1 Show 5 moreShow less7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u17:3.2.9-1~deb9u1 |
7:3.2.15-0+deb9u1 |
ffmpegDebian:10 |
before 7:4.1.6-1~deb10u1, plus listed versions 7:4.1.3-17:4.1.4-17:4.1.4-1~deb10u1 |
7:4.1.6-1~deb10u1 |
ffmpegSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 |
before 3.4.2-150200.11.25.1 | 3.4.2-150200.11.25.1 |
ffmpegSUSE:Linux Enterprise Module for Package Hub 15 SP4 |
before 3.4.2-150200.11.25.1 | 3.4.2-150200.11.25.1 |
ffmpegSUSE:Linux Enterprise Real Time 15 SP3 |
before 3.4.2-150200.11.25.1 | 3.4.2-150200.11.25.1 |
ffmpegSUSE:Linux Enterprise Workstation Extension 15 SP4 |
before 3.4.2-150200.11.25.1 | 3.4.2-150200.11.25.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegopenSUSE:Leap 15.4 |
before 3.4.2-150200.11.25.1 | 3.4.2-150200.11.25.1 |
ffmpegSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 3.4.2-150000.4.53.2 | 3.4.2-150000.4.53.2 |
ffmpegSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 3.4.2-150000.4.53.2 | 3.4.2-150000.4.53.2 |
ffmpegSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 3.4.2-150000.4.53.2 | 3.4.2-150000.4.53.2 |
ffmpegSUSE:Enterprise Storage 6 |
before 3.4.2-150000.4.53.2 | 3.4.2-150000.4.53.2 |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.17-0ubuntu0.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 11 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1 |
7:2.8.17-0ubuntu0.1 |
ffmpegUbuntu:18.04:LTS |
before 7:3.4.8-0ubuntu0.2, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 7 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.1 |
7:3.4.8-0ubuntu0.2 |
ffmpegUbuntu:20.04:LTS |
before 7:4.2.4-1ubuntu0.1, plus listed versions 7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1 |
7:4.2.4-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13390 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published July 7, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in ffmpeg 4.0.6-r0.
References
trac.ffmpeg.org/ticket/7979
securityfocus.com/bid/109090
security.gentoo.org/glsa/202003-65
debian.org/security/2020/dsa-4722
lists.debian.org/debian-lts-announce/2020/07/msg00022.html
usn.ubuntu.com/4431-1
Show 27 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-13390
github.com/advisories/GHSA-5gmr-mpx2-2vqh
security.alpinelinux.org/vuln/CVE-2019-13390
security-tracker.debian.org/tracker/CVE-2019-13390
suse.com/support/update/announcement/2023/suse-su-20230206-1
bugzilla.suse.com/1140754
ubuntu.com/security/CVE-2019-13390
cve.org/CVERecord?id=CVE-2019-13390