CVE-2017-9608
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause...
CVE-2017-9608 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published August 13, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in ffmpeg 3.2.6-r0.
- Severity
- 6.5 MediumCVSS 3.0, NVD
- Exploit chance
- 4.58%EPSS, 91st percentile
- Exploitation
- None known1 public exploit
- Fixed in
3.2.6-r0ffmpeg +6 more
Description
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.6 | 3.3 up to 3.2.6-r0 | 3.2.6-r0 |
ffmpegDebian:12 | before 7:3.3.3-1 | 7:3.3.3-1 |
ffmpegDebian:13 | before 7:3.3.3-1 | 7:3.3.3-1 |
ffmpegDebian:14 | before 7:3.3.3-1 | 7:3.3.3-1 |
ffmpegDebian:9 From an advisory covering 5 CVEs | before 7:3.2.7-1~deb9u1, plus listed versions 7:3.2.5-17:3.2.6-1 | 7:3.2.7-1~deb9u1 |
ffmpegMageia:6 | before 3.3.3-1.mga6 | 3.3.3-1.mga6 |
ffmpegMageia:6 | before 3.3.3-1.mga6.tainted | 3.3.3-1.mga6.tainted |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | LaCinquette/practice-22-23 | 2022-12-16 |
What each source reports
NVD Score used
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
CVE-2017-9608- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE ListNo score
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
CVE-2017-9608- Updated
- 2026-11-02
EUVDEUVD-2017-18539No score
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
EUVD-2017-18539- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gj8f-pc7g-p9w6
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause...
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
GHSA-gj8f-pc7g-p9w6- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-9608
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
ALPINE-CVE-2017-9608- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
CVE-2017-9608- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2017-9608
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
- Record
DEBIAN-CVE-2017-9608- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0262No score
Updated ffmpeg packages fix security vulnerabilities
This update provides ffmpeg version 3.3.3, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2017-0262- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/FFmpeg/FFmpeg/commit/0a709e2a10b8288a0cc383547924ecfe285cef89
securityfocus.com/bid/100348
debian.org/security/2017/dsa-3957
openwall.com/lists/oss-security/2017/08/15/8
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-9608
security.alpinelinux.org/vuln/CVE-2017-9608
security-tracker.debian.org/tracker/CVE-2017-9608
advisories.mageia.org/MGASA-2017-0262.html
bugs.mageia.org/show_bug.cgi?id=21407
git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n3.3.3
ffmpeg.org/download.html