Vulnerability Database

314,343

Total vulnerabilities in the database

CVE-2017-9996

The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

  • Published: Jun 28, 2017
  • Updated: Nov 9, 2025
  • CVE: CVE-2017-9996
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
ffmpeg / ffmpeg 3.1.3 3.1.3.x
ffmpeg / ffmpeg 3.2 3.2.x
ffmpeg / ffmpeg 3.1.1 3.1.1.x
ffmpeg / ffmpeg 3.0.1 3.0.1.x
ffmpeg / ffmpeg 3.0.2 3.0.2.x
ffmpeg / ffmpeg 2.8.4 2.8.4.x
ffmpeg / ffmpeg 3.1.4 3.1.4.x
ffmpeg / ffmpeg 2.8.8 2.8.8.x
ffmpeg / ffmpeg 3.2.4 3.2.4.x
ffmpeg / ffmpeg 3.1.7 3.1.7.x
ffmpeg / ffmpeg 2.8.9 2.8.9.x
ffmpeg / ffmpeg 3.1.6 3.1.6.x
ffmpeg / ffmpeg 2.8.5 2.8.5.x
ffmpeg / ffmpeg 2.8.2 2.8.2.x
ffmpeg / ffmpeg 2.8.1 2.8.1.x
ffmpeg / ffmpeg 3.0.5 3.0.5.x
ffmpeg / ffmpeg 2.8.11 2.8.11.x
ffmpeg / ffmpeg 3.1.5 3.1.5.x
ffmpeg / ffmpeg 2.8.10 2.8.10.x
ffmpeg / ffmpeg 3.0.3 3.0.3.x
ffmpeg / ffmpeg 2.8.6 2.8.6.x
ffmpeg / ffmpeg 3.2.1 3.2.1.x
ffmpeg / ffmpeg 3.0.7 3.0.7.x
ffmpeg / ffmpeg 3.2.3 3.2.3.x
ffmpeg / ffmpeg 3.0.4 3.0.4.x
ffmpeg / ffmpeg 3.2.2 3.2.2.x
ffmpeg / ffmpeg 2.8 2.8.x
ffmpeg / ffmpeg 3.0 3.0.x
ffmpeg / ffmpeg 2.8.3 2.8.3.x
ffmpeg / ffmpeg 3.3 3.3.x
ffmpeg / ffmpeg 3.1 3.1.x
ffmpeg / ffmpeg 3.0.6 3.0.6.x
ffmpeg / ffmpeg 2.8.7 2.8.7.x
ffmpeg / ffmpeg 3.1.2 3.1.2.x