{"id":"CVE-2021-30145","aliases":["ALPINE-CVE-2021-30145","DEBIAN-CVE-2021-30145","EUVD-2021-17082","GHSA-mf25-jq7f-vx34","JLSEC-2026-476","MGASA-2021-0235","OESA-2024-1722","OESA-2024-1929","OESA-2024-1930","UBUNTU-CVE-2021-30145","openSUSE-SU-2021:0788-1","openSUSE-SU-2021:0798-1"],"status":"published","title":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to...","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02429,"percentile":0.84367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2021-05-18T13:34:53Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"mpv","fixed_in":["0.33.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mpv","fixed_in":["0.32.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mpv","fixed_in":["0.32.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mpv","fixed_in":["0.32.0-3"],"sources":["osv"]},{"ecosystem":"Julia","package":"mpv_jll","fixed_in":["0.41.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"mpv","fixed_in":["0.29.1-8.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"mpv","fixed_in":["0.32.0-6.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"mpv","fixed_in":["0.32.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"mpv","fixed_in":["0.32.0-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mpv","fixed_in":["0.32.0-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"mpv","fixed_in":["0.32.0+git.20200301T004003.e7bab0025f-lp152.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"mpv","fixed_in":["0.32.0+git.20200301T004003.e7bab0025f-bp152.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3"}]}]},{"source":"osv","ecosystem":"Julia","package":"mpv_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.41.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.1-8.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-6.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1ubuntu2","0.12.0-1","0.14.0-1","0.14.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.0-3ubuntu1","0.26.0-3ubuntu2","0.27.0-2ubuntu2","0.27.0-2ubuntu3","0.27.0-2ubuntu4","0.27.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.1-1ubuntu1","0.30.0-1ubuntu1","0.32.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.33.1-1ubuntu1","0.34.0-2ubuntu1","0.34.1-1ubuntu1","0.34.1-1ubuntu2","0.34.1-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0+git.20200301T004003.e7bab0025f-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"mpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0+git.20200301T004003.e7bab0025f-bp152.2.6.1"}]}]}],"products":[{"vendor":"mpv","product":"mpv"}],"references":[{"url":"https://mpv.io","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory","web"]},{"url":"https://github.com/mpv-player/mpv/releases/tag/v0.33.1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://devel0pment.de/?p=2217","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/mpv-player/mpv/commit/d0c530919d8cd4d7a774e38ab064e0fabdae34e6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.gentoo.org/glsa/202107-46","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30145","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mf25-jq7f-vx34"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-30145","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-30145","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0235.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29058","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QVXB4F67QODLPKYBZX7SBXTE7ESGKGOD/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1722","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1929","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1930","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-30145","tags":["report"]},{"url":"https://github.com/mpv-player/mpv/commit/cb3fa04bcb2ba9e0d25788480359157208c13e0b","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30145","tags":["report"]},{"url":"https://bugzilla.suse.com/1186230","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30145","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7RIJ3BHGUNK7E25ETV52KEDWICBG46XA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T13:34:53Z","modified":"2024-08-03T22:24:59.537Z","updated_at":"2026-11-02T14:33:02.20241Z"}],"euvd":[{"id":"EUVD-2021-17082","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T13:34:53Z","modified":"2024-08-03T22:24:59Z","updated_at":"2026-11-03T03:24:42.963555Z"}],"ghsa":[{"id":"GHSA-mf25-jq7f-vx34","title":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to...","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2022-05-24T19:02:43Z","modified":"2023-01-29T05:06:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:45:59.496932Z"}],"nvd":[{"id":"CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T14:15:07.377Z","modified":"2026-06-17T03:49:44.47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:06:53.343329Z"}],"osv":[{"id":"ALPINE-CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T14:15:07.377Z","modified":"2026-11-03T06:32:47.036849996Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T14:15:07.377Z","modified":"2026-10-20T14:22:33.325063038Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T14:15:07.377Z","modified":"2026-10-23T18:03:26.3872566Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"JLSEC-2026-476","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2026-05-07T17:22:10.706Z","modified":"2026-07-18T00:02:06.107256626Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-1722","title":"mpv security update","description":"Mpv is a movie player based on MPlayer and mplayer2. It supports a wide variety of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different video and audio output methods are supported.\r\n\r\nSecurity Fix(es):\r\n\r\nA format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.(CVE-2021-30145)","status":"published","published":"2024-06-14T11:07:11Z","modified":"2026-08-18T01:17:24.147417742Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1929","title":"mpv security update","description":"Mpv is a movie player based on MPlayer and mplayer2. It supports a wide variety of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different video and audio output methods are supported.\r\n\r\nSecurity Fix(es):\r\n\r\nA format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.(CVE-2021-30145)","status":"published","published":"2024-08-02T11:07:23Z","modified":"2026-08-18T01:18:31.739701003Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1930","title":"mpv security update","description":"Mpv is a movie player based on MPlayer and mplayer2. It supports a wide variety of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different video and audio output methods are supported.\r\n\r\nSecurity Fix(es):\r\n\r\nA format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.(CVE-2021-30145)","status":"published","published":"2024-08-02T11:07:23Z","modified":"2026-08-18T01:18:31.977000384Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2021-30145","description":"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.","status":"published","published":"2021-05-18T14:15:00Z","modified":"2026-04-22T12:52:35.016417Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"MGASA-2021-0235","title":"Updated mpv packages fix a security vulnerability","description":"Fixed format string vulnerability allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file (CVE-2021-30145).\n","status":"published","published":"2021-06-08T14:33:02Z","modified":"2026-04-16T04:42:32.399473967Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0788-1","title":"Security update for mpv","description":"This update for mpv fixes the following issues:\n\n- CVE-2021-30145: Fixed format string vulnerability allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file (boo#1186230)\n","status":"published","published":"2021-05-24T12:03:34Z","modified":"2026-02-04T04:06:10.494827Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0798-1","title":"Security update for mpv","description":"This update for mpv fixes the following issues:\n\n- CVE-2021-30145: Fixed format string vulnerability allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file (boo#1186230)\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-05-27T18:05:12Z","modified":"2025-05-07T18:12:45.02144Z","updated_at":"2026-11-02T16:58:31.879684Z"}]}}