High
Security advisory
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-14225
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:00 UTC · Revision 1
Source evidence
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
osv:CVE-2017-14225
Complete source record
{
"id": "5f2167804770199233c13e612540023e27ab286473d679b41aa91419c8aaf8ad",
"url": "https://osv.dev/vulnerability/CVE-2017-14225",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-14225",
"summary": "The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)",
"evidence": "osv:CVE-2017-14225",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-14225",
"aliases": [
"CVE-2017-14225"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.ffmpeg.org/ffmpeg.git",
"type": "GIT",
"events": [
{
"introduced": "9079c70d2095643af6954001d0627445650b85a6"
},
{
"last_affected": "9079c70d2095643af6954001d0627445650b85a6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3.3"
},
{
"last_affected": "3.3.3"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.3.3",
"n3.3.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14225.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/ffmpeg/ffmpeg",
"type": "GIT",
"events": [
{
"introduced": "9079c70d2095643af6954001d0627445650b85a6"
},
{
"last_affected": "9079c70d2095643af6954001d0627445650b85a6"
},
{
"fixed": "837cb4325b712ff1aab531bf41668933f61d75d2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3.3"
},
{
"last_affected": "3.3.3"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "837cb4325b712ff1aab531bf41668933f61d75d2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.3.3",
"n3.3.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14225.json",
"vanir_signatures": [
{
"id": "CVE-2017-14225-32b61689",
"digest": {
"length": 5905,
"function_hash": "77237116678450317504861665754180746434"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2",
"target": {
"file": "ffprobe.c",
"function": "show_frame"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-14225-e7272f5d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221450128087687587250176144148539325100",
"282117115556129521606131410372994239809",
"59784664286405779544678447087242695979",
"200757870420612979136223310417180935883",
"206983465700293464012508019338495991932",
"324204992978656004876786522199568591030",
"226824868637655105243935053886954605496",
"166212197245934879213542457693968098175",
"97749407353548720685995098263829641855",
"175713908596454300390988151989973892858",
"288572632161953875206801612015841901566",
"151068263833046034148541722557307827477",
"98960862588415697634310055435198106487",
"272058216663923336752368374852584756776",
"23575878678631716555516987196522829083",
"308682154026749192593265264339310955803",
"58346193510396188170803353064167596741"
]
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2",
"target": {
"file": "ffprobe.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-14225-fe236c92",
"digest": {
"length": 6846,
"function_hash": "103073554096209478277459715807172093870"
},
"source": "https://github.com/ffmpeg/ffmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2",
"target": {
"file": "ffprobe.c",
"function": "show_stream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:03:15Z"
}
}
],
"modified": "2026-10-24T14:03:15.615823879Z",
"provider": "osv",
"references": [
"https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2",
"https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-August/215198.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-14225",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442775,
"published_at": "2017-09-09T08:29:00.193+00:00"
}