CVE-2018-13303
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the...
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
CVE-2018-13303- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
CVE-2018-13303- Updated
- 2026-11-02
EUVDEUVD-2018-5251 No score
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
EUVD-2018-5251- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rrxj-m39q-79v3
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the...
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
GHSA-rrxj-m39q-79v3- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
CVE-2018-13303- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2018-13303
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
DEBIAN-CVE-2018-13303- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-13303
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
- Record
UBUNTU-CVE-2018-13303- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:4.0.2-1 | 7:4.0.2-1 |
ffmpegDebian:13 |
before 7:4.0.2-1 | 7:4.0.2-1 |
ffmpegDebian:14 |
before 7:4.0.2-1 | 7:4.0.2-1 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
gst-libav1.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.6.0-21.6.1-11.6.2-11.7.1-1 Show 7 moreShow less1.7.2-11.7.90-11.8.0-11.8.1-1~ubuntu11.8.2-1~ubuntu11.8.3-1ubuntu0.11.8.3-1ubuntu0.2 |
None known |
kinoUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.4-2.1build2 |
None known |
mythtvUbuntu:16.04:LTS |
All versions, plus listed versions 2:0.27.1+fixes.20140624.aa822f5-0ubuntu62:0.27.1+fixes.20140624.aa822f5-0ubuntu72:0.27.1+fixes.20140624.aa822f5-0ubuntu92:0.28.0+fixes.20160217.44fd8a6-0ubuntu42:0.28.0+fixes.20160229.ae35a28-0ubuntu1 Show 6 moreShow less2:0.28.0+fixes.20160321.39e409d-0ubuntu12:0.28.0+fixes.20160321.39e409d-0ubuntu22:0.28.0+fixes.20160325.2520617-0ubuntu32:0.28.0+fixes.20160413.15cf421-0ubuntu12:0.28.0+fixes.20160413.15cf421-0ubuntu22:0.28.0+fixes.20160413.15cf421-0ubuntu2.16.04.1 |
None known |
gst-libav1.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1.12.2-11.12.3-11.12.4-11.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-0ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
None known |
kinoUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.4-2.31.3.4-2.4 |
None known |
mythtvUbuntu:18.04:LTS |
All versions, plus listed versions 2:29.0+fixes.20170728.696806310a-0ubuntu12:29.0+fixes.20170728.696806310a-0ubuntu32:29.0+fixes.20170728.696806310a-0ubuntu42:29.0+fixes.20170728.696806310a-0ubuntu52:29.0+fixes.20170728.696806310a-0ubuntu6 Show 5 moreShow less2:29.0+fixes.20170728.696806310a-0ubuntu72:29.0+fixes.20170728.696806310a-0ubuntu82:29.1+fixes.20180220.9b7b962-0ubuntu22:29.1+fixes.20180220.9b7b962-0ubuntu32:29.1+fixes.20180414.329c235-0ubuntu3 |
None known |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gst-libav1.0Ubuntu:20.04:LTS |
All versions, plus listed versions 1.16.1-11.16.2-11.16.2-2 |
None known |
kinoUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.4+dfsg0-11.3.4+dfsg0-1build1 |
None known |
mythtvUbuntu:20.04:LTS |
All versions, plus listed versions 2:30.0+fixes.20190817.5cde0578d8-0ubuntu12:30.0+fixes.20190817.5cde0578d8-0ubuntu22:30.0+fixes.20190817.5cde0578d8-0ubuntu32:31.0+fixes.20200207.35cb9ed0c5-0ubuntu22:31.0+fixes.20200323.9579662cdc-0ubuntu1 |
None known |
chromium-browserUbuntu:22.04:LTS |
All versions, plus listed versions 1:85.0.4183.83-0ubuntu21:85.0.4183.83-0ubuntu2.22.04.1 |
None known |
gst-libav1.0Ubuntu:22.04:LTS |
All versions, plus listed versions 1.18.5-11.20.0-11.20.1-11.20.3-0ubuntu1 |
None known |
kinoUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.4+dfsg0-1build21.3.4+dfsg0-1.1 |
None known |
mythtvUbuntu:22.04:LTS |
All versions, plus listed versions 2:31.0+fixes.20200323.9579662cdc-0ubuntu92:31.0+fixes.20200323.9579662cdc-0ubuntu112:32.0+fixes.20220224.56275b303b-0ubuntu32:32.0+fixes.20220224.56275b303b-0ubuntu52:32.0+fixes.20220325.f69ce764b7-0ubuntu1 |
None known |
chromium-browserUbuntu:24.04:LTS |
All versions, plus listed versions 1:85.0.4183.83-0ubuntu32:1snap1-0ubuntu12:1snap1-0ubuntu2 |
None known |
gst-libav1.0Ubuntu:24.04:LTS |
All versions, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
None known |
mythtvUbuntu:24.04:LTS |
All versions, plus listed versions 2:33.0+fixes.20230210.026e506-0ubuntu02:33.0+fixes.20230210.026e506-0ubuntu22:33.0+fixes.20230210.026e506-0ubuntu32:33.0+fixes.20230210.026e506-0ubuntu42:33.0+fixes.20230210.026e506-0ubuntu5 Show 4 moreShow less2:34.0+fixes.20240210.e3e165a1-0ubuntu12:34.0+fixes.20240210.e3e165a1-0ubuntu42:34.0+fixes.20240210.e3e165a1-0ubuntu52:34.0+fixes.20240210.e3e165a1-0ubuntu6 |
None known |
chromium-browserUbuntu:25.10 |
All versions, plus listed versions 2:1snap1-0ubuntu3 |
None known |
gst-libav1.0Ubuntu:25.10 |
All versions, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.3-11.26.4-11.26.5-11.26.6-1 |
None known |
mythtvUbuntu:25.10 |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu32:35.0+fixes.20250302.f3f012aa3f-0ubuntu4 |
None known |
chromium-browserUbuntu:26.10 |
All versions, plus listed versions 2:1snap1-0ubuntu4 |
None known |
gst-libav1.0Ubuntu:26.10 |
All versions, plus listed versions 1.28.2-11.28.3-11.28.4-1build11.28.5-11.28.6-11.28.7-1 |
None known |
mythtvUbuntu:26.10 |
All versions, plus listed versions 2:36.0+fixes.20260401.1385cbfc60-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu3 |
None known |
chromium-browserUbuntu:26.04:LTS |
All versions, plus listed versions 2:1snap1-0ubuntu32:1snap1-0ubuntu4 |
None known |
gst-libav1.0Ubuntu:26.04:LTS |
All versions, plus listed versions 1.26.6-11.27.2-11.27.2-1build11.27.90-11.28.0-11.28.1-11.28.2-1 |
None known |
mythtvUbuntu:26.04:LTS |
All versions, plus listed versions 2:35.0+fixes.20250302.f3f012aa3f-0ubuntu42:35.0+fixes.20250302.f3f012aa3f-0ubuntu52:35.0+fixes.20250302.f3f012aa3f-0ubuntu62:35.0+fixes.20250302.f3f012aa3f-0ubuntu72:36.0+fixes.20260210.a312d68f-0ubuntu12:36.0+fixes.20260401.1385cbfc60-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-13303 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published July 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in ffmpeg 7:4.0.2-1.