Every CVE Search/ Get API key

CVE-2021-28429

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg...

5.5 MediumFix available

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.20%Up 0.2 points since Aug 12, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
CVE-2021-28429
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
CVE-2021-28429
Updated
2026-11-02
EUVDEUVD-2021-15108 No score

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
EUVD-2021-15108
Updated
2026-11-03
GitHub AdvisoriesGHSA-9g32-j225-76c5 5.5

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg...

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
GHSA-9g32-j225-76c5
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 5.5

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
CVE-2021-28429
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-07
OSVDEBIAN-CVE-2021-28429 5.5

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
DEBIAN-CVE-2021-28429
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2024-1831 5.5

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.(CVE-2021-28429)

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.(CVE-2022-3341)

Record
OESA-2024-1831
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1832 5.5

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.(CVE-2021-28429)

Record
OESA-2024-1832
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1833 5.5

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.(CVE-2021-28429)

Record
OESA-2024-1833
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1834 5.5

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.(CVE-2021-28429)

Record
OESA-2024-1834
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-28429 5.5

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

Record
UBUNTU-CVE-2021-28429
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2023:3818-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

  • CVE-2021-28429: Fixed Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c (bsc#1214246).
Record
SUSE-SU-2023:3818-1
Updated
2026-11-02
OSVUSN-6430-1 No score

ffmpeg vulnerabilities

It was discovered that FFmpeg did not properly handle certain inputs in vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22024)

It was discovered that FFmpeg incorrectly managed memory in avienc.c, resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service via application crash. (CVE-2020-22039)

It was discovered that FFmpeg incorrectly handled certain files due to a memory leak in frame.c. An attacker could possibly use this issue to cause a denial of service via application crash. This issue affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22040)

It was discovered that FFmpeg incorrectly handled certain files due to a memory leak in fifo.c. An attacker could possibly use this issue to cause a denial of service via application crash. (CVE-2020-22043)

It was discovered that FFmpeg incorrectly handled certain files due to a memory leak in vf_tile.c. If a user or automated system were tricked into processing a specially crafted MOV file, an attacker could possibly use this issue to cause a denial of service. (CVE-2020-22051)

It was discovered that FFmpeg incorrectly handled certain MOV files in timecode.c, leading to an integer overflow. An attacker could possibly use this issue to cause a denial of service using a crafted MOV file. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-28429)

Record
USN-6430-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:12
 before 7:4.4-5
7:4.4-5
ffmpeg
Debian:13
 before 7:4.4-5
7:4.4-5
ffmpeg
Debian:14
 before 7:4.4-5
7:4.4-5
ffmpeg
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 4.2.4-14.oe2203sp4
4.2.4-14.oe2203sp4
ffmpeg
openEuler:22.03-LTS-SP1
 before 4.2.4-14.oe2203sp1
4.2.4-14.oe2203sp1
ffmpeg
openEuler:22.03-LTS-SP3
 before 4.2.4-14.oe2203sp3
4.2.4-14.oe2203sp3
ffmpeg
openEuler:20.03-LTS-SP4
 before 4.2.4-15.oe2003sp4
4.2.4-15.oe2003sp4
ffmpeg
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
SUSE:Linux Enterprise Module for Package Hub 15 SP4
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
ffmpeg
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
SUSE:Linux Enterprise Workstation Extension 15 SP4
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
SUSE:Linux Enterprise Workstation Extension 15 SP5
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
openSUSE:Leap 15.4
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
openSUSE:Leap 15.5
 before 3.4.2-150200.11.31.1
3.4.2-150200.11.31.1
ffmpeg
Ubuntu:Pro:16.04:LTS
 before 7:2.8.17-0ubuntu0.1+esm6, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 18 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm5
7:2.8.17-0ubuntu0.1+esm6
ffmpeg
Ubuntu:18.04:LTS
 before 7:3.4.11-0ubuntu0.1, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 8 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.2
7:3.4.11-0ubuntu0.1
ffmpeg
Ubuntu:20.04:LTS
 before 7:4.2.7-0ubuntu0.1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu17:4.2.4-1ubuntu0.1
7:4.2.7-0ubuntu0.1
ffmpeg
Ubuntu:Pro:16.04:LTS
From an advisory covering 6 CVEs
 before 7:2.8.17-0ubuntu0.1+esm6, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 18 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm5
7:2.8.17-0ubuntu0.1+esm6
ffmpeg
Ubuntu:Pro:18.04:LTS
From an advisory covering 6 CVEs
 before 7:3.4.11-0ubuntu0.1+esm2, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 10 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm1
7:3.4.11-0ubuntu0.1+esm2
ffmpeg
Ubuntu:Pro:20.04:LTS
From an advisory covering 6 CVEs
 before 7:4.2.7-0ubuntu0.1+esm2, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1
Show 4 moreShow less
7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm1
7:4.2.7-0ubuntu0.1+esm2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-28429 is a medium vulnerability (CVSS 5.5) in Ffmpeg, published August 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in ffmpeg 7:4.4-5.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open