{"id":"CVE-2021-38091","aliases":["DEBIAN-CVE-2021-38091","EUVD-2021-24564","GHSA-x7q6-g5fx-vhrw","SUSE-SU-2024:1468-1","UBUNTU-CVE-2021-38091","USN-6449-1"],"status":"published","title":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in...","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01271,"percentile":0.70257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2021-09-20T15:20:01Z","modified":"2026-10-24T14:21:16Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm3"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm3"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm3"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm2"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1"],"bundled":8}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://trac.ffmpeg.org/ticket/8263","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38091"},{"url":"https://github.com/advisories/GHSA-x7q6-g5fx-vhrw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38091","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241468-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190721","tags":["report"]},{"url":"https://bugzilla.suse.com/1190724","tags":["report"]},{"url":"https://bugzilla.suse.com/1190727","tags":["report"]},{"url":"https://bugzilla.suse.com/1190728","tags":["report"]},{"url":"https://bugzilla.suse.com/1190731","tags":["report"]},{"url":"https://bugzilla.suse.com/1190732","tags":["report"]},{"url":"https://bugzilla.suse.com/1223070","tags":["report"]},{"url":"https://bugzilla.suse.com/1223235","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31578","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-38091","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6449-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-20898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-22038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48434","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38091","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T15:20:01Z","modified":"2024-08-04T01:30:09.106Z","updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24564","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T15:20:01Z","modified":"2024-08-04T01:30:09Z","updated_at":"2026-11-03T03:24:25.678078Z"}],"ghsa":[{"id":"GHSA-x7q6-g5fx-vhrw","title":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in...","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2022-05-24T19:15:11Z","modified":"2023-01-30T05:02:18Z","cwes":["CWE-190"],"updated_at":"2026-11-02T14:46:36.123786Z"}],"nvd":[{"id":"CVE-2021-38091","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:11.32Z","modified":"2026-06-17T04:01:26.823Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:58.933037Z"}],"osv":[{"id":"CVE-2021-38091","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:11.32Z","modified":"2026-11-07T13:17:59.801722408Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2021-38091","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:11.32Z","modified":"2026-10-23T18:05:23.011198798Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"UBUNTU-CVE-2021-38091","description":"Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:00Z","modified":"2026-04-22T12:57:38.098161Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"SUSE-SU-2024:1468-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2024-31578: Fixed heap use-after-free via av_hwframe_ctx_init() when vulkan_frames init failed (bsc#1223070)\n- CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in libavfilter/bwdifdsp.c (bsc#1223235)\n\nAdding references for already fixed issues:\n  \n- CVE-2021-38091: Fixed integer overflow in function filter16_sobel in libavfilter/vf_convolution.c (bsc#1190732)\n- CVE-2021-38090: Fixed integer overflow in function filter16_roberts in libavfilter/vf_convolution.c (bsc#1190731)\n- CVE-2020-20898: Fixed integer overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c (bsc#1190724)\n- CVE-2020-20901: Fixed buffer overflow vulnerability in function filter_frame in libavfilter/vf_fieldorder.c (bsc#1190728)\n- CVE-2020-20900: Fixed buffer overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190727)\n- CVE-2020-20894: Fixed buffer Overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190721)   \n","status":"published","published":"2024-04-29T15:59:01Z","modified":"2026-02-04T04:07:49.682421Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6449-1","title":"ffmpeg vulnerabilities","description":"It was discovered that FFmpeg incorrectly managed memory resulting \nin a memory leak. An attacker could possibly use this issue to cause\na denial of service via application crash. This issue only \naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22038)\n\nIt was discovered that FFmpeg incorrectly handled certain input files, \nleading to an integer overflow. An attacker could possibly use this issue\nto cause a denial of service via application crash. This issue only \naffected Ubuntu 20.04 LTS. (CVE-2020-20898, CVE-2021-38090, \nCVE-2021-38091, CVE-2021-38092, CVE-2021-38093, CVE-2021-38094)\n\nIt was discovered that FFmpeg incorrectly managed memory, resulting in\na memory leak.  If a user or automated system were tricked into \nprocessing a specially crafted input file, a remote attacker could\npossibly use this issue to cause a denial of service, or execute \narbitrary code. (CVE-2022-48434)\n","status":"published","published":"2023-10-24T10:26:27Z","modified":"2026-04-27T16:47:21.537921233Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}