CVE-2023-49501
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute...
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2023-53459
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
EUVD-2023-53459- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jfff-gxr9-9j6r
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute...
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
GHSA-jfff-gxr9-9j6r- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-49501
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
ALPINE-CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
OSV
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-07
Show 5 moreShow less
OSVDEBIAN-CVE-2023-49501
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
DEBIAN-CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2203
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.(CVE-2023-49501)
- Record
OESA-2024-2203- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-49501
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.
- Record
UBUNTU-CVE-2023-49501- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13895-1No score
ffmpeg-6-6.1.1-4.1 on GA media
These are all security issues fixed in the ffmpeg-6-6.1.1-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13895-1- Updated
- 2026-11-02
OSVUSN-6803-1No score
ffmpeg vulnerabilities
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-49501)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-49502)
Zhang Ling and Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-49528)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-50007)
Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-50008)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10. (CVE-2023-50009)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50010)
Zeng Yunxiang and Li Zeyuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51793)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-51794, CVE-2023-51798)
Zeng Yunxiang discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10. (CVE-2023-51795, CVE-2023-51796)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31578)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-31582)
It was discovered that discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting…
- Record
USN-6803-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.23 | before 7.1.1-r0 | 7.1.1-r0 |
ffmpegAlpine:v3.24 | before 7.1.1-r0 | 7.1.1-r0 |
ffmpegDebian:13 | before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegDebian:14 | before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegopenEuler:24.03-LTS | before 6.1.1-14.oe2403 | 6.1.1-14.oe2403 |
libavUbuntu:Pro:14.04:LTS | All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 | None known |
ffmpegUbuntu:Pro:24.04:LTS | before 7:6.1.1-3ubuntu5+esm1, plus listed versions 7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1 Show 4 moreShow less7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu5 | 7:6.1.1-3ubuntu5+esm1 |
ffmpegUbuntu:Pro:16.04:LTS From an advisory covering 14 CVEs | before 7:2.8.17-0ubuntu0.1+esm7, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 19 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm57:2.8.17-0ubuntu0.1+esm6 | 7:2.8.17-0ubuntu0.1+esm7 |
ffmpegUbuntu:Pro:18.04:LTS From an advisory covering 14 CVEs | before 7:3.4.11-0ubuntu0.1+esm5, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 13 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm27:3.4.11-0ubuntu0.1+esm37:3.4.11-0ubuntu0.1+esm4 | 7:3.4.11-0ubuntu0.1+esm5 |
ffmpegUbuntu:Pro:20.04:LTS From an advisory covering 14 CVEs | before 7:4.2.7-0ubuntu0.1+esm5, plus listed versions 7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1 Show 7 moreShow less7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm27:4.2.7-0ubuntu0.1+esm37:4.2.7-0ubuntu0.1+esm4 | 7:4.2.7-0ubuntu0.1+esm5 |
ffmpegUbuntu:Pro:22.04:LTS From an advisory covering 14 CVEs | before 7:4.4.2-0ubuntu0.22.04.1+esm4, plus listed versions 7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu3 Show 5 moreShow less7:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm27:4.4.2-0ubuntu0.22.04.1+esm3 | 7:4.4.2-0ubuntu0.22.04.1+esm4 |
ffmpegUbuntu:Pro:24.04:LTS From an advisory covering 14 CVEs | before 7:6.1.1-3ubuntu5+esm1, plus listed versions 7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1 Show 4 moreShow less7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu5 | 7:6.1.1-3ubuntu5+esm1 |
ffmpeg-6openSUSE:Tumbleweed From an advisory covering 5 CVEs | before 6.1.1-4.1 | 6.1.1-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49501 is a high vulnerability (CVSS 8.0) in Ffmpeg, published April 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in ffmpeg 7.1.1-r0.
References
github.com/FFmpeg/FFmpeg
trac.ffmpeg.org/ticket/10686
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY
Show 30 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-49501
security.alpinelinux.org/vuln/CVE-2023-49501
security-tracker.debian.org/tracker/CVE-2023-49501
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2203
ubuntu.com/security/CVE-2023-49501
cve.org/CVERecord?id=CVE-2023-49501
suse.com/security/cve/CVE-2023-49501
Left out here: the rest of 1 source description. The JSON record has them.