Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2…

published 2017-02-09 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-1378

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.5%; EPSS 7.5% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

Patch / fix

fixed in 1 distros 4 links 3

ffmpeg ffmpeg 2.8.10, 3.0.5, 3.1.6, 3.2.2

debian ubuntu opensuse alpine

ffmpeg Debian 14, Debian 13, Debian 12 7:3.2.2-1

debian advisories DEBIAN-CVE-2016-10191

ffmpeg Ubuntu 16.04 LTS 7:2.8.11-0ubuntu0.16.04.1

ubuntu advisories UBUNTU-CVE-2016-10191

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

ffmpeg-4 openSUSE Tumbleweed 4.4-5.2
ffmpeg Package Hub 12 SP2 3.1.8-8.1
ffmpeg2 Package Hub 12 SP1 2.8.11-12.1

opensuse advisories openSUSE-SU-2024:10754-1 openSUSE-SU-2017:1531-1 openSUSE-SU-2017:1532-1

ffmpeg Alpine 3.3 2.8.11-r0
ffmpeg Alpine 3.4 3.0.7-r0

alpine advisories ALPINE-CVE-2016-10191

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/FFmpeg/FFmpeg@7d57ca4 commit
openwall.com/lists/oss-security/2017/01/31/12 advisory
openwall.com/lists/oss-security/2017/02/02/1 advisory

Exploit prediction

7.46% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

github.com /FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7
patch
openwall.com /lists/oss-security/2017/01/31/12
mailing-list, patch, third-party-advisory
openwall.com /lists/oss-security/2017/02/02/1
mailing-list, patch, third-party-advisory
ffmpeg.org /security.html
release-notes, vendor-advisory
lists.debian.org /debian-lts-announce/2018/12/msg00009.html
mailing-list
securityfocus.com /bid/95989
vdb-entry

Sources

CVE List CVE-2016-10191
NVD CVE-2016-10191

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Add more accurate affected version ranges.

Summary