CVE-2011-3936 json
The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x be…
published 2012-08-20 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-3889
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file.
Patch / fix
- ffmpeg Debian 14, Debian 13, Debian 12 7:2.4.1-1
debian advisories DEBIAN-CVE-2011-3936
Exploit prediction
2.54% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
ubuntu.com
/usn/USN-1479-1
vendor-advisory
-
debian.org
/security/2012/dsa-2471
vendor-advisory
-
secunia.com
/advisories/49089
third-party-advisory
- ffmpeg.org /
- libav.org /
- git.libav.org /?p=libav.git%3Ba=commit%3Bh=635bcfccd439480003b74a665b5aa7c872c1ad6b
- git.libav.org /?p=libav.git%3Ba=commitdiff%3Bh=2d1c0dea5f6b91bec7f5fa53ec050913d851e366
Sources
- CVE List CVE-2011-3936
- NVD CVE-2011-3936
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.