High
Security advisory
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-9992
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:08 UTC · Revision 1
Source evidence
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
osv:CVE-2017-9992
Complete source record
{
"id": "dd06059e7f8acf66f9c973f1fab3b366063a93881ce79b7985b10a74c1701afb",
"url": "https://osv.dev/vulnerability/CVE-2017-9992",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-9992",
"summary": "Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.",
"evidence": "osv:CVE-2017-9992",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-9992",
"aliases": [
"CVE-2017-9992"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.ffmpeg.org/ffmpeg.git",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ffab459e4e491384756cf8bae0f3922c5e4f6271"
},
{
"introduced": "c40983a6f631d22fede713d535bb9c31d5c9740c"
},
{
"fixed": "b33d01d8a253028083df250b5d4a2e43e5560c64"
},
{
"introduced": "fbc96c50d72f55131e43939e38c1e5af4315a755"
},
{
"fixed": "9b9a620ce6983ea56a0b94501e4661d2ccf916d8"
},
{
"introduced": "340cea9f22c162e10d120835661e132721b7454b"
},
{
"fixed": "5d737a3d0ca2bf0f0c6170096d9d1ca230cf9ee0"
},
{
"introduced": "efa89a841941bf61d1a3eb5c2900f98e3e7db85b"
},
{
"fixed": "c1c50650df6cef69c392ad0d544c30e571e24214"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.8.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"n3.3",
"n3.2.4",
"n2.8.11",
"n3.0.7",
"n3.1.7",
"n3.2.3",
"n3.0.6",
"n2.8.10",
"n3.0.5",
"n3.2.2",
"n3.1.6",
"n2.8.9",
"n3.2.1",
"n3.1.5",
"n3.0.4",
"n3.2",
"n3.3-dev",
"n3.1.4",
"n3.0.3",
"n2.8.8",
"n3.1.3",
"n3.1.2",
"n2.8.7",
"n3.1.1",
"n3.1",
"n3.2-dev",
"n3.0.2",
"n3.0.1",
"n3.0",
"n3.1-dev",
"n2.8.6",
"n2.8.5",
"n2.8.4",
"n2.8.3",
"n2.8.2",
"n2.8.1",
"n2.8",
"n2.8-dev",
"n2.7-dev",
"n2.6-dev",
"n2.5-dev",
"n2.4-dev",
"n2.3-dev",
"n2.2-dev",
"n2.0",
"n2.1-dev",
"n1.3-dev",
"n1.2-dev",
"n1.1-dev",
"n0.12-dev",
"n0.11-dev",
"n0.8",
"N"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9992.json",
"vanir_signatures": [
{
"id": "CVE-2017-9992-0bb34f86",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171761850885783161694918931923155613653",
"287454683090357633262522277026531572655",
"283892481322314227092797983348005820398",
"220739420317396261739711762453104130432"
]
},
"source": "https://git.ffmpeg.org/ffmpeg.git@5d737a3d0ca2bf0f0c6170096d9d1ca230cf9ee0",
"target": {
"file": "libavformat/tests/fifo_muxer.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:10:57Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/ffmpeg/ffmpeg",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ffab459e4e491384756cf8bae0f3922c5e4f6271"
},
{
"introduced": "c40983a6f631d22fede713d535bb9c31d5c9740c"
},
{
"fixed": "b33d01d8a253028083df250b5d4a2e43e5560c64"
},
{
"introduced": "fbc96c50d72f55131e43939e38c1e5af4315a755"
},
{
"fixed": "9b9a620ce6983ea56a0b94501e4661d2ccf916d8"
},
{
"introduced": "340cea9f22c162e10d120835661e132721b7454b"
},
{
"fixed": "5d737a3d0ca2bf0f0c6170096d9d1ca230cf9ee0"
},
{
"introduced": "efa89a841941bf61d1a3eb5c2900f98e3e7db85b"
},
{
"fixed": "c1c50650df6cef69c392ad0d544c30e571e24214"
},
{
"fixed": "f52fbf4f3ed02a7d872d8a102006f29b4421f360"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.8.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "f52fbf4f3ed02a7d872d8a102006f29b4421f360"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"n3.3",
"n3.4-dev",
"n3.2.4",
"n2.8.11",
"n3.0.7",
"n3.1.7",
"n3.2.3",
"n3.0.6",
"n2.8.10",
"n3.0.5",
"n3.2.2",
"n3.1.6",
"n2.8.9",
"n3.2.1",
"n3.1.5",
"n3.0.4",
"n3.2",
"n3.3-dev",
"n3.1.4",
"n3.0.3",
"n2.8.8",
"n3.1.3",
"n3.1.2",
"n2.8.7",
"n3.1.1",
"n3.1",
"n3.2-dev",
"n3.0.2",
"n3.0.1",
"n3.0",
"n3.1-dev",
"n2.8.6",
"n2.8.5",
"n2.8.4",
"n2.8.3",
"n2.8.2",
"n2.8.1",
"n2.8",
"n2.8-dev",
"n2.7-dev",
"n2.6-dev",
"n2.5-dev",
"n2.4-dev",
"n2.3-dev",
"n2.2-dev",
"n2.0",
"n2.1-dev",
"n1.3-dev",
"n1.2-dev",
"n1.1-dev",
"n0.12-dev",
"n0.11-dev",
"n0.8",
"N"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9992.json",
"vanir_signatures": [
{
"id": "CVE-2017-9992-31eccf5a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171761850885783161694918931923155613653",
"287454683090357633262522277026531572655",
"283892481322314227092797983348005820398",
"220739420317396261739711762453104130432"
]
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/5d737a3d0ca2bf0f0c6170096d9d1ca230cf9ee0",
"target": {
"file": "libavformat/tests/fifo_muxer.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-9992-60fa412b",
"digest": {
"length": 1168,
"function_hash": "173690714667852622426013926318516017828"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360",
"target": {
"file": "libavcodec/dfa.c",
"function": "decode_dds1"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-9992-a8b5c31e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"49292181257551172576771973708726667050",
"51557325619138272839030920394370860057",
"143321983408069829629295156302111297253",
"168494076503263253939609218673331973402"
]
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360",
"target": {
"file": "libavcodec/dfa.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:10:57Z"
}
}
],
"modified": "2026-10-24T14:10:57.617026180Z",
"provider": "osv",
"references": [
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1345",
"https://github.com/FFmpeg/FFmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-9992",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443198,
"published_at": "2017-06-28T06:29:00.487+00:00"
}