High
Security advisory
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11338
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:23 UTC · Revision 1
Source evidence
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
osv:CVE-2019-11338
Complete source record
{
"id": "86b7a009ed2ad62111f4fd52c2234d296670b5119a5a98692f184555e27612fc",
"url": "https://osv.dev/vulnerability/CVE-2019-11338",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11338",
"summary": "libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.",
"evidence": "osv:CVE-2019-11338",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-11338",
"aliases": [
"CVE-2019-11338"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.ffmpeg.org/ffmpeg.git",
"type": "GIT",
"events": [
{
"introduced": "22b0daa1b3f0ac5d91cc1a057d230995590847cd"
},
{
"last_affected": "a7cb7a2e4314956e06a351333ff8096fab9afa7f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4"
},
{
"last_affected": "3.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:4.1.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.2"
},
{
"last_affected": "4.1.2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.4",
"4.1.2",
"n4.1.2",
"n4.1.1",
"n4.1",
"n4.1-dev",
"n3.5-dev",
"n3.4-dev"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11338.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/ffmpeg/ffmpeg",
"type": "GIT",
"events": [
{
"introduced": "22b0daa1b3f0ac5d91cc1a057d230995590847cd"
},
{
"last_affected": "a7cb7a2e4314956e06a351333ff8096fab9afa7f"
},
{
"fixed": "54655623a82632e7624714d7b2a3e039dc5faa7e"
},
{
"fixed": "9ccc633068c6fe76989f487c8932bd11886ad65b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4"
},
{
"last_affected": "3.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:4.1.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.2"
},
{
"last_affected": "4.1.2"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "54655623a82632e7624714d7b2a3e039dc5faa7e"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "9ccc633068c6fe76989f487c8932bd11886ad65b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.4",
"4.1.2",
"n4.1.2",
"n4.1.1",
"n3.4.5",
"n4.1",
"n4.2-dev",
"n3.4.4",
"n3.4.3",
"n4.1-dev",
"n3.4.2",
"n3.4.1",
"n3.4",
"n3.5-dev",
"n3.4-dev"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11338.json",
"vanir_signatures": [
{
"id": "CVE-2019-11338-27b24530",
"digest": {
"length": 3748,
"function_hash": "45059981939637157877700820184160513142"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
"target": {
"file": "libavcodec/hevcdec.c",
"function": "decode_nal_unit"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11338-2ff1770d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"167280379000740045495955150237615756625",
"217014810008278832315784870144539884880",
"275342592106358026505968957521723311896",
"93282334362186985464861588891659759283",
"20102417044240740358849022761902872871",
"315077692536051889598880836078603069425",
"70136499457010029194053811280640163862",
"143535213550679828004584463617263301076",
"128790428654206636083008055072316941250",
"317589072920574188696555524382694908121",
"230507251567370162258824489236627234082",
"326752629143355640910394448450558654154",
"272291046614698887552076985666997168650",
"184162110970024235939528314086827681328",
"138312105946242993354180976917596471857"
]
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
"target": {
"file": "libavcodec/hevcdec.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11338-50b395ac",
"digest": {
"length": 14167,
"function_hash": "331539604942389623747355164843225661104"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
"target": {
"file": "libavcodec/hevcdec.c",
"function": "hls_slice_header"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11338-57cefee5",
"digest": {
"length": 5011,
"function_hash": "267982237115177009869281056395071073673"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
"target": {
"file": "libavcodec/hevcdec.c",
"function": "decode_nal_unit"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11338-70732dfc",
"digest": {
"length": 14204,
"function_hash": "79026117247124224733924662327854734242"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
"target": {
"file": "libavcodec/hevcdec.c",
"function": "hls_slice_header"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11338-f5c87da6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"167280379000740045495955150237615756625",
"217014810008278832315784870144539884880",
"275342592106358026505968957521723311896",
"93282334362186985464861588891659759283",
"20102417044240740358849022761902872871",
"247604245573560918611417214280701552476",
"203456488689133841884968569597706019293",
"226504480904387125210540704722477978516",
"230507251567370162258824489236627234082",
"326752629143355640910394448450558654154",
"272291046614698887552076985666997168650",
"184162110970024235939528314086827681328",
"138312105946242993354180976917596471857"
]
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b",
"target": {
"file": "libavcodec/hevcdec.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:20:21Z"
}
}
],
"modified": "2026-10-24T14:20:21.255097431Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html",
"https://seclists.org/bugtraq/2019/May/60",
"https://usn.ubuntu.com/3967-1/",
"https://usn.ubuntu.com/4431-1/",
"https://www.debian.org/security/2019/dsa-4449",
"https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e",
"https://github.com/FFmpeg/FFmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
},
{
"introduced": "19.04"
},
{
"last_affected": "19.04"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:novell:suse_package_hub_for_suse_linux_enterprise:12:*:*:*:*:*:*:*"
],
"vendor_product": "novell:suse_package_hub_for_suse_linux_enterprise",
"extracted_events": [
{
"range": [
{
"introduced": "12"
},
{
"last_affected": "12"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-11338",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443530,
"published_at": "2019-04-19T00:29:00.23+00:00"
}