libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause…

published 2014-11-05 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-8379

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.5%; EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

Patch / fix

distros 2

debian ubuntu

ffmpeg Debian 14, Debian 13, Debian 12 7:2.4.3-1

debian advisories DEBIAN-CVE-2014-8542

libav Ubuntu 14.04 LTS 6:9.18-0ubuntu0.14.04.1

ubuntu advisories UBUNTU-CVE-2014-8542

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

2.49% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

ubuntu.com /usn/USN-2534-1
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201603-06
vendor-advisory, third-party-advisory
ffmpeg.org /security.html
vendor-advisory
git.videolan.org /?p=ffmpeg.git%3Ba=commit%3Bh=105654e376a736d243aef4a1d121abebce912e6b
lists.debian.org /debian-lts-announce/2019/02/msg00005.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2014-8542
NVD CVE-2014-8542

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary