CVE-2018-7751
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers...
6.5 MediumFix available
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.24%Up 0.9 points since Apr 14, 2021
What each source reports
NVD Score used
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
CVE-2018-7751- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
CVE-2018-7751- Updated
- 2026-11-02
EUVDEUVD-2018-19464 No score
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
EUVD-2018-19464- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fxmr-5w2h-wcxc
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers...
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
GHSA-fxmr-5w2h-wcxc- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-7751
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
ALPINE-CVE-2018-7751- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
CVE-2018-7751- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-7751
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
DEBIAN-CVE-2018-7751- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-7751
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
- Record
UBUNTU-CVE-2018-7751- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score
ffmpeg-4-4.4-5.2 on GA media
These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10754-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.10 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.11 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.12 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.13 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.14 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.15 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.16 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.17 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.18 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.19 |
before 3.4.3-r0 | 3.4.3-r0 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.20 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.21 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.22 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.23 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.24 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.8 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegAlpine:v3.9 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.16 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.17 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.18 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.19 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.20 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.21 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpeg4Alpine:v3.22 |
before 3.4.3-r0 | 3.4.3-r0 |
ffmpegDebian:12 |
before 7:3.4.3-1 | 7:3.4.3-1 |
ffmpegDebian:13 |
before 7:3.4.3-1 | 7:3.4.3-1 |
ffmpegDebian:14 |
before 7:3.4.3-1 | 7:3.4.3-1 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
gst-libav1.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.6.0-21.6.1-11.6.2-11.7.1-1 Show 7 moreShow less1.7.2-11.7.90-11.8.0-11.8.1-1~ubuntu11.8.2-1~ubuntu11.8.3-1ubuntu0.11.8.3-1ubuntu0.2 |
None known |
mythtvUbuntu:16.04:LTS |
All versions, plus listed versions 2:0.27.1+fixes.20140624.aa822f5-0ubuntu62:0.27.1+fixes.20140624.aa822f5-0ubuntu72:0.27.1+fixes.20140624.aa822f5-0ubuntu92:0.28.0+fixes.20160217.44fd8a6-0ubuntu42:0.28.0+fixes.20160229.ae35a28-0ubuntu1 Show 6 moreShow less2:0.28.0+fixes.20160321.39e409d-0ubuntu12:0.28.0+fixes.20160321.39e409d-0ubuntu22:0.28.0+fixes.20160325.2520617-0ubuntu32:0.28.0+fixes.20160413.15cf421-0ubuntu12:0.28.0+fixes.20160413.15cf421-0ubuntu22:0.28.0+fixes.20160413.15cf421-0ubuntu2.16.04.1 |
None known |
ffmpegUbuntu:18.04:LTS |
before 7:3.4.4-0ubuntu0.18.04.1, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 5 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-2 |
7:3.4.4-0ubuntu0.18.04.1 |
gst-libav1.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1.12.2-11.12.3-11.12.4-11.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-0ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
None known |
mythtvUbuntu:18.04:LTS |
All versions, plus listed versions 2:29.0+fixes.20170728.696806310a-0ubuntu12:29.0+fixes.20170728.696806310a-0ubuntu32:29.0+fixes.20170728.696806310a-0ubuntu42:29.0+fixes.20170728.696806310a-0ubuntu52:29.0+fixes.20170728.696806310a-0ubuntu6 Show 5 moreShow less2:29.0+fixes.20170728.696806310a-0ubuntu72:29.0+fixes.20170728.696806310a-0ubuntu82:29.1+fixes.20180220.9b7b962-0ubuntu22:29.1+fixes.20180220.9b7b962-0ubuntu32:29.1+fixes.20180414.329c235-0ubuntu3 |
None known |
gst-libav1.0Ubuntu:20.04:LTS |
All versions, plus listed versions 1.16.1-11.16.2-11.16.2-2 |
None known |
mythtvUbuntu:20.04:LTS |
All versions, plus listed versions 2:30.0+fixes.20190817.5cde0578d8-0ubuntu12:30.0+fixes.20190817.5cde0578d8-0ubuntu22:30.0+fixes.20190817.5cde0578d8-0ubuntu32:31.0+fixes.20200207.35cb9ed0c5-0ubuntu22:31.0+fixes.20200323.9579662cdc-0ubuntu1 |
None known |
gst-libav1.0Ubuntu:22.04:LTS |
All versions, plus listed versions 1.18.5-11.20.0-11.20.1-11.20.3-0ubuntu1 |
None known |
mythtvUbuntu:22.04:LTS |
All versions, plus listed versions 2:31.0+fixes.20200323.9579662cdc-0ubuntu92:31.0+fixes.20200323.9579662cdc-0ubuntu112:32.0+fixes.20220224.56275b303b-0ubuntu32:32.0+fixes.20220224.56275b303b-0ubuntu52:32.0+fixes.20220325.f69ce764b7-0ubuntu1 |
None known |
gst-libav1.0Ubuntu:24.04:LTS |
All versions, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
None known |
mythtvUbuntu:24.04:LTS |
All versions, plus listed versions 2:33.0+fixes.20230210.026e506-0ubuntu02:33.0+fixes.20230210.026e506-0ubuntu22:33.0+fixes.20230210.026e506-0ubuntu32:33.0+fixes.20230210.026e506-0ubuntu42:33.0+fixes.20230210.026e506-0ubuntu5 Show 4 moreShow less2:34.0+fixes.20240210.e3e165a1-0ubuntu12:34.0+fixes.20240210.e3e165a1-0ubuntu42:34.0+fixes.20240210.e3e165a1-0ubuntu52:34.0+fixes.20240210.e3e165a1-0ubuntu6 |
None known |
gst-libav1.0Ubuntu:25.10 |
All versions, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.3-11.26.4-11.26.5-11.26.6-1 |
None known |
mythtvUbuntu:25.10 |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu32:35.0+fixes.20250302.f3f012aa3f-0ubuntu4 |
None known |
gst-libav1.0Ubuntu:26.10 |
All versions, plus listed versions 1.28.2-11.28.3-11.28.4-1build11.28.5-11.28.6-11.28.7-1 |
None known |
mythtvUbuntu:26.10 |
All versions, plus listed versions 2:36.0+fixes.20260401.1385cbfc60-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu3 |
None known |
gst-libav1.0Ubuntu:26.04:LTS |
All versions, plus listed versions 1.26.6-11.27.2-11.27.2-1build11.27.90-11.28.0-11.28.1-11.28.2-1 |
None known |
mythtvUbuntu:26.04:LTS |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu42:35.0+fixes.20250302.f3f012aa3f-0ubuntu52:35.0+fixes.20250302.f3f012aa3f-0ubuntu62:35.0+fixes.20250302.f3f012aa3f-0ubuntu72:36.0+fixes.20260210.a312d68f-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu1 |
None known |
ffmpeg-4openSUSE:Tumbleweed |
before 4.4-5.2 | 4.4-5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7751 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published April 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in ffmpeg 3.4.3-r0.
References
securityfocus.com/bid/103956
git.ffmpeg.org/gitweb/ffmpeg.git/commit/a6cba062051f345e8ebfdff34aba071ed73d923f
security.gentoo.org/glsa/202003-65
nvd.nist.gov/vuln/detail/CVE-2018-7751
github.com/advisories/GHSA-fxmr-5w2h-wcxc
security.alpinelinux.org/vuln/CVE-2018-7751
Show 49 moreShow less
security-tracker.debian.org/tracker/CVE-2018-7751
ubuntu.com/security/CVE-2018-7751
cve.org/CVERecord?id=CVE-2018-7751
suse.com/security/cve/CVE-2015-8216