CVE-2023-51795
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute...
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
CVE-2023-51795- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2023-56479 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
EUVD-2023-56479- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ppm8-gjfw-8977 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute...
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
GHSA-ppm8-gjfw-8977- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
CVE-2023-51795- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSV 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
CVE-2023-51795- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2023-51795 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
DEBIAN-CVE-2023-51795- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVJLSEC-2026-637 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
JLSEC-2026-637- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-51795 8.0
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame
- Record
UBUNTU-CVE-2023-51795- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0248No score
Updated ffmpeg packages fix security vulnerabilities
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the set_encoder_id function in /fftools/ffmpeg_enc.c component. (CVE-2023-50010) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane. (CVE-2023-51793) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69. (CVE-2023-51794) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame. (CVE-2023-51795) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate. (CVE-2023-51798) FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVE-2024-31585)
- Record
MGASA-2024-0248- Updated
- 2026-11-02
OSVUSN-6803-1No score
ffmpeg vulnerabilities
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-49502)
Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-49528)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-50007)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-50008)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10. (CVE-2023-50009)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50010)
Zeng Yunxiang and Li Zeyuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51793)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51794, CVE-2023-51798)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10. (CVE-2023-51795, CVE-2023-51796)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31578)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31582)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting…
- Record
USN-6803-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 | before 7:5.1.5-0+deb12u1, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u1 | 7:5.1.5-0+deb12u1 |
ffmpegDebian:13 | before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegDebian:14 | before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegDebian:12 From an advisory covering 10 CVEs | before 7:5.1.5-0+deb12u1, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u1 | 7:5.1.5-0+deb12u1 |
FFMPEG_jllJulia | 7.1.0+0 up to 8.1.0+0 | 8.1.0+0 |
FFMPEG_nogpl_jllJulia | before 8.1.0+0 | 8.1.0+0 |
FFplay_jllJulia | 7.1.0+0 up to 8.1.2+0 | 8.1.2+0 |
ffmpegMageia:9 From an advisory covering 6 CVEs | before 5.1.5-1.mga9 | 5.1.5-1.mga9 |
ffmpegMageia:9 From an advisory covering 6 CVEs | before 5.1.5-1.mga9.tainted | 5.1.5-1.mga9.tainted |
libavUbuntu:Pro:14.04:LTS | All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 | None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegUbuntu:Pro:16.04:LTS From an advisory covering 14 CVEs | before 7:2.8.17-0ubuntu0.1+esm7, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 19 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm57:2.8.17-0ubuntu0.1+esm6 | 7:2.8.17-0ubuntu0.1+esm7 |
ffmpegUbuntu:Pro:18.04:LTS From an advisory covering 14 CVEs | before 7:3.4.11-0ubuntu0.1+esm5, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 13 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm27:3.4.11-0ubuntu0.1+esm37:3.4.11-0ubuntu0.1+esm4 | 7:3.4.11-0ubuntu0.1+esm5 |
ffmpegUbuntu:Pro:20.04:LTS From an advisory covering 14 CVEs | before 7:4.2.7-0ubuntu0.1+esm5, plus listed versions 7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1 Show 7 moreShow less7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm27:4.2.7-0ubuntu0.1+esm37:4.2.7-0ubuntu0.1+esm4 | 7:4.2.7-0ubuntu0.1+esm5 |
ffmpegUbuntu:Pro:22.04:LTS From an advisory covering 14 CVEs | before 7:4.4.2-0ubuntu0.22.04.1+esm4, plus listed versions 7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu3 Show 5 moreShow less7:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm27:4.4.2-0ubuntu0.22.04.1+esm3 | 7:4.4.2-0ubuntu0.22.04.1+esm4 |
ffmpegUbuntu:Pro:24.04:LTS From an advisory covering 14 CVEs | before 7:6.1.1-3ubuntu5+esm1, plus listed versions 7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1 Show 4 moreShow less7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu5 | 7:6.1.1-3ubuntu5+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-51795 is a high vulnerability (CVSS 8.0) in Ffmpeg, published April 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in ffmpeg 7:5.1.5-0+deb12u1.
References
ffmpeg.org
trac.ffmpeg.org/ticket/10749
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN
Show 25 moreShow less
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY
nvd.nist.gov/vuln/detail/CVE-2023-51795
github.com/advisories/GHSA-ppm8-gjfw-8977
github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51795.json
security-tracker.debian.org/tracker/CVE-2023-51795
advisories.mageia.org/MGASA-2024-0248.html
bugs.mageia.org/show_bug.cgi?id=33338
lists.debian.org/debian-security-announce/2024/msg00122.html
ubuntu.com/security/CVE-2023-51795
cve.org/CVERecord?id=CVE-2023-51795
ubuntu.com/security/notices/USN-6803-1
ubuntu.com/security/CVE-2023-49501
ubuntu.com/security/CVE-2023-49502
ubuntu.com/security/CVE-2023-49528
ubuntu.com/security/CVE-2023-50007
ubuntu.com/security/CVE-2023-50008
ubuntu.com/security/CVE-2023-50009
ubuntu.com/security/CVE-2023-50010
ubuntu.com/security/CVE-2023-51793
ubuntu.com/security/CVE-2023-51794
ubuntu.com/security/CVE-2023-51796
ubuntu.com/security/CVE-2023-51798
ubuntu.com/security/CVE-2024-31578
ubuntu.com/security/CVE-2024-31582
ubuntu.com/security/CVE-2024-31585
Left out here: the rest of 1 source description. The JSON record has them.