{"id":"CVE-2023-6604","aliases":["ALPINE-CVE-2023-6604","DEBIAN-CVE-2023-6604","DLA-4241-1","DSA-5985-1","EUVD-2023-58827","GHSA-j6rq-mppc-h3jr","JLSEC-2025-148","MGASA-2025-0306","OESA-2026-3875","OESA-2026-3876","OESA-2026-3877","OESA-2026-3878","OESA-2026-4075","UBUNTU-CVE-2023-6604","openSUSE-SU-2026:12417-1","openSUSE-SU-2026:21877-1"],"status":"published","title":"Ffmpeg: hls xbin demuxer dos amplification in ffmpeg","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00466,"percentile":0.40615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94","CWE-99"],"published":"2025-01-06T16:41:42Z","modified":"2026-11-09T12:49:26Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"ffmpeg","fixed_in":["7.1.1-r0","8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["7.1.1-r0","8.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:7.1.1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["6.1.1+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["7.1.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","fixed_in":["4.2.4-56.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","fixed_in":["4.2.4-56.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"7.1.1-r0"},{"fixed":"8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"7.1.1-r0"},{"fixed":"8.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3.9-0+deb11u1"}]}],"versions":["7:4.3.2-0+deb11u2","7:4.3.2-1","7:4.3.2-2","7:4.3.3-0+deb11u1","7:4.3.4-0+deb11u1","7:4.3.5-0+deb11u1","7:4.3.6-0+deb11u1","7:4.3.7-0+deb11u1","7:4.3.8-0+deb11u1","7:4.3.8-0+deb11u2","7:4.3.8-0+deb11u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.7-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1"],"bundled":16},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.1+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-1.mga9.tainted"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-51.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-51.oe2403sp3"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-56.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-56.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-51.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16","7:4.2.7-0ubuntu0.1+esm17","7:4.2.7-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu1","7:7.1.1-1ubuntu2","7:7.1.1-1ubuntu3","7:7.1.1-1ubuntu4","7:7.1.1-1ubuntu4.1","7:7.1.1-1ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2-5.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2334337","tags":["issue-tracking","x_refsource_REDHAT","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j6rq-mppc-h3jr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-6604","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6604.json","tags":["advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-6604","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0306.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34757","tags":["report"]},{"url":"https://ffmpeg.org/security.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00149.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3877","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3878","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4075","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6604","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96611","tags":["web"]},{"url":"https://bugzilla.suse.com/1220546","tags":["report"]},{"url":"https://bugzilla.suse.com/1220549","tags":["report"]},{"url":"https://bugzilla.suse.com/1234017","tags":["report"]},{"url":"https://bugzilla.suse.com/1234029","tags":["report"]},{"url":"https://bugzilla.suse.com/1237382","tags":["report"]},{"url":"https://bugzilla.suse.com/1268595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269490","tags":["report"]},{"url":"https://bugzilla.suse.com/1269550","tags":["report"]},{"url":"https://bugzilla.suse.com/1272755","tags":["report"]},{"url":"https://bugzilla.suse.com/1272757","tags":["report"]},{"url":"https://bugzilla.suse.com/1272759","tags":["report"]},{"url":"https://bugzilla.suse.com/1272760","tags":["report"]},{"url":"https://bugzilla.suse.com/1272761","tags":["report"]},{"url":"https://bugzilla.suse.com/1272762","tags":["report"]},{"url":"https://bugzilla.suse.com/1272763","tags":["report"]},{"url":"https://bugzilla.suse.com/1272764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274268","tags":["report"]},{"url":"https://bugzilla.suse.com/1274270","tags":["report"]},{"url":"https://bugzilla.suse.com/1274282","tags":["report"]},{"url":"https://bugzilla.suse.com/1274287","tags":["report"]},{"url":"https://bugzilla.suse.com/1274289","tags":["report"]},{"url":"https://bugzilla.suse.com/1276407","tags":["report"]},{"url":"https://bugzilla.suse.com/1276408","tags":["report"]},{"url":"https://bugzilla.suse.com/1276409","tags":["report"]},{"url":"https://bugzilla.suse.com/1276410","tags":["report"]},{"url":"https://bugzilla.suse.com/1276412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8461","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-6604","title":"Ffmpeg: hls xbin demuxer dos amplification in ffmpeg","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T16:41:42.345Z","modified":"2025-11-03T19:29:03.485Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-99","CWE-94"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-58827","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T16:41:42Z","modified":"2025-11-03T19:29:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-j6rq-mppc-h3jr","title":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage...","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T18:31:03Z","modified":"2025-11-03T21:32:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-94","CWE-99"],"updated_at":"2026-11-02T15:04:19.844682Z"}],"nvd":[{"id":"CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T17:15:14.413Z","modified":"2026-06-17T06:51:04.497Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-99","CWE-94"],"updated_at":"2026-11-02T14:09:20.080574Z"}],"osv":[{"id":"ALPINE-CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T17:15:14.413Z","modified":"2026-11-03T06:32:03.096257817Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2023-6604","title":"Ffmpeg: hls xbin demuxer dos amplification in ffmpeg","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T16:41:42.345Z","modified":"2026-11-07T10:47:21.262935083Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-99"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T17:15:14.413Z","modified":"2026-10-26T18:02:54.33317368Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"JLSEC-2025-148","title":"A flaw was found in FFmpeg","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-10-19T19:08:53.76Z","modified":"2026-07-18T00:00:20.265920773Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2026-3875","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.(CVE-2023-6604)\n\nOut of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)(CVE-2026-13858)","status":"published","published":"2026-09-20T13:22:48Z","modified":"2026-09-20T13:30:21.792259459Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3876","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.(CVE-2023-6604)\n\nOut of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)(CVE-2026-13858)\n\nA flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.(CVE-2026-18393)\n\nA flaw was found in FFmpeg. An integer overflow in the `libavfilter/vf_scale.c` component allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing.(CVE-2026-38343)\n\nA flaw was found in FFmpeg. This vulnerability involves a NULL pointer dereference within the `get_min_buffer_size` function when processing specially crafted video files. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service (DoS). A Denial of Service attack prevents legitimate users from accessing a service or resource.(CVE-2026-38344)\n\nA flaw was found in FFmpeg. An integer overflow vulnerability in the `yuv2planeX_8_c()` function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing, impacting system availability.(CVE-2026-38346)\n\nA flaw was found in FFmpeg. A heap overflow vulnerability exists in the `ff_sws_alphablendaway` function. This flaw allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input. Successful exploitation could lead to the application becoming unresponsive or crashing.(CVE-2026-38347)\n\nA flaw was found in FFmpeg, specifically within the libswscale/utils.c component. An integer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This could lead to the application becoming unresponsive or crashing.(CVE-2026-38348)\n\nA flaw was found in FFmpeg. An integer overflow vulnerability in the `hScale16To19_c()` function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This can lead to the application becoming unresponsive or crashing, preventing legitimate users from accessing the service.(CVE-2026-38349)","status":"published","published":"2026-09-20T13:22:49Z","modified":"2026-09-20T13:30:21.787516005Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3877","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.(CVE-2023-6604)","status":"published","published":"2026-09-20T13:22:49Z","modified":"2026-09-20T13:30:21.786466092Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3878","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.(CVE-2023-6604)","status":"published","published":"2026-09-20T13:22:50Z","modified":"2026-09-20T13:30:21.793873774Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4075","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.(CVE-2023-6604)\n\nOut of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)(CVE-2026-13858)","status":"published","published":"2026-09-25T01:28:05Z","modified":"2026-09-25T01:45:11.314695888Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.","status":"published","published":"2025-01-06T17:15:00Z","modified":"2026-11-09T12:49:26.461476485Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"DLA-4241-1","title":"ffmpeg - security update","status":"published","published":"2025-07-14T00:00:00Z","modified":"2026-03-09T02:08:55.81328Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5985-1","title":"ffmpeg - security update","status":"published","published":"2025-08-25T00:00:00Z","modified":"2026-03-09T02:10:26.171906Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0306","title":"Updated ffmpeg packages fix security vulnerabilities","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a\nparameter of negative size in the av_samples_set_silence function in\nthelibavutil/samplefmt.c:260:9 component. (CVE-2023-50007)\nFFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the\ncolorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9\ncomponent. (CVE-2023-50008)\nImproper handling of input format in tty demuxer of ffmpeg.\n(CVE-2023-6602)\nHls xbin demuxer dos amplification in ffmpeg. (CVE-2023-6604)\nDash playlist ssrf vulnerability in ffmpeg. (CVE-2023-6605)\nFFmpeg version n6.1 was discovered to contain a heap buffer overflow\nvulnerability in the draw_block_rectangle function of\nlibavfilter/vf_codecview.c. This vulnerability allows attackers to cause\nundefined behavior or a Denial of Service (DoS) via crafted input.\n(CVE-2024-31582)\nFFmpeg n6.1.1 has an Out-of-bounds Read via\nlibavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\nh_subpel_filters_outer. (CVE-2024-35367)\nHeap-buffer-overflow write in FFmpeg MDASH resolve_content_path.\n(CVE-2025-59728)\nHeap-buffer-overflow write in FFmpeg EXR dwa_uncompress.\n(CVE-2025-59731, CVE-2025-59732, CVE-2025-59733)\nNull pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c).\n(CVE-2025-7700)\n","status":"published","published":"2025-11-21T19:56:16Z","modified":"2026-04-16T04:44:27.513245693Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:12417-1","title":"ffmpeg-9-libavcodec-devel-9.0.2-5.1 on GA media","description":"These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.2-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-04T00:00:00Z","modified":"2026-11-05T17:23:17.424674949Z","updated_at":"2026-11-05T17:55:05.69587Z"},{"id":"openSUSE-SU-2026:21877-1","title":"Security update for ffmpeg-7","description":"This update for ffmpeg-7 fixes the following issues:\n\n- CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).\n- CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).\n- CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8\n  h_subpel_filters_outer (bsc#1234029).\n- CVE-2024-36615: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if\n  video encoding parameters were being exported, as the side data would be attached in the decoder thread while\n  (bsc#1234017).\n- CVE-2025-22921: segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c\n  (bsc#1237382).\n- CVE-2026-8461: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder (bsc#1269490).\n- CVE-2026-12706: ffmpeg: heap use-after-free read in RASC decoder decode_move() (bsc#1268595).\n- CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory\n  corruption (bsc#1269550).\n- CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (bsc#1272755).\n- CVE-2026-64834: Infinite Loop DoS via RTP/ASF Demuxer (bsc#1272757).\n- CVE-2026-65703: Out-of-Bounds Write in TDSC Video Decoder (bsc#1272759).\n- CVE-2026-65704: Out-of-Bounds Write via TY Demuxer and Shorten Decoder (bsc#1272760).\n- CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).\n- CVE-2026-65706: vf_swaprect Out-of-Bounds Write via NV12 Frame Processing (bsc#1272762).\n- CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).\n- CVE-2026-66037: IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (bsc#1272764).\n- CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).\n- CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads\n  (bsc#1274270).\n- CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory\n  reads (bsc#1274282).\n- CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads\n  (bsc#1274287).\n- CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes\n  (bsc#1274289).\n- CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).\n- CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).\n- CVE-2026-75143: heap buffer overflow in the RIST protocol reader (bsc#1276409).\n- CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).\n- CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).\n\nChanges for ffmpeg-7:\n\nUpdate to version 7.1.5:\n * Various crash, out-of-bounds access, add boundary check\n fixes. Affected: .mov parser, DASH parser, Snow encoder,\n Icecast, RTSP decoder, RV10/RV34 RealVideo, Truespeech,\n ADPCM, Matroska decoder\n * avcodec/jpeg2000dec: clear array length when freeing it\n (CVE-2025-22921, bsc#1237382)\n * avcodec/magicyuv: Fix 1 line MEDIAN slices\n (CVE-2026-8461, bsc#1269490)\n * avcodec/magicyuv: reject slice_height misaligned with chroma vshift.\n * avcodec/magicyuv: Expand the s-\u003einterlaced slice-height sanity check.\n * avcodec/rasc: fix heap use-after-free in decode_move().\n (CVE-2026-12706, bsc#1268595)\n * avformat/hls: Be more picky on extensions.\n (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549)\n * lavc/vp9: Fix regression introduced in 0ba0585. It is possible that ff_progress_frame_await() is\n calledbut ff_progress_frame_report() isn't called when a hardware acceleration method is used, so\n a thread for vp9 decoding might get stuck.\n (CVE-2024-36615, bsc#1234017).\n * avcodec/vp9: Fix race when attaching side-data for show-existing frame. (commit: 0ba0585)\n (CVE-2024-36615, bsc#1234017)\n * lavc/vp9: Fix regression introduced in 0ba0585.\n * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and\n h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6.\n (CVE-2024-35367, bsc#1234029)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.629800263Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}