FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common Encryption) subsample data to libavformat/mov.c.
| Vendor | Product | Versions |
|---|---|---|
| ffmpeg | ffmpeg | 4.1 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | ffmpeg | cert_advisory | 90% |
Updated vendor to FFmpeg, affected versions to include 8.0, changed severity to HIGH, marked as actively exploited, and noted that no exploit is available.
Initial creation
