Every CVE Search/ Get API key

CVE-2017-16840

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a...

9.8 CriticalFix available

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.33%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
CVE-2017-16840
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
CVE-2017-16840
Updated
2026-11-02
EUVDEUVD-2017-8014 No score

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
EUVD-2017-8014
Updated
2026-11-03
GitHub AdvisoriesGHSA-m395-w54c-5rmj 9.8

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a...

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
GHSA-m395-w54c-5rmj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 9.8

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
CVE-2017-16840
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVDEBIAN-CVE-2017-16840 9.8

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
DEBIAN-CVE-2017-16840
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-16840 9.8

The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.

Record
UBUNTU-CVE-2017-16840
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0116 No score

Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 3.3.6, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record
MGASA-2018-0116
Updated
2026-11-02
OSVopenSUSE-SU-2018:0470-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0470-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0476-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0476-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score

ffmpeg-4-4.4-5.2 on GA media

These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10754-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:12
 before 7:3.4.1-1
7:3.4.1-1
ffmpeg
Debian:13
 before 7:3.4.1-1
7:3.4.1-1
ffmpeg
Debian:14
 before 7:3.4.1-1
7:3.4.1-1
ffmpeg
Debian:9
From an advisory covering 3 CVEs
 before 7:3.2.9-1~deb9u1, plus listed versions
7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u1
7:3.2.9-1~deb9u1
ffmpeg
Mageia:6
From an advisory covering 2 CVEs
 before 3.3.6-1.mga6
3.3.6-1.mga6
ffmpeg
Mageia:6
From an advisory covering 2 CVEs
 before 3.3.6-1.mga6.tainted
3.3.6-1.mga6.tainted
ffmpeg
SUSE:Package Hub 12 SP2
From an advisory covering 7 CVEs
 before 3.4.2-14.1
3.4.2-14.1
ffmpeg-4
openSUSE:Tumbleweed
From an advisory covering 46 CVEs
 before 4.4-5.2
4.4-5.2

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-16840 is a critical vulnerability (CVSS 9.8) in Ffmpeg, published November 21, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.33%, the 88th percentile. Fixed in ffmpeg 7:3.4.1-1.

References

Show 62 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open