Information Disclosure in FFmpeg via MPEG-4 ALS File

Executive Summary

This vulnerability in FFmpeg through 9.0.2 allows attackers to disclose uninitialized heap memory by exploiting malformed MPEG-4 ALS files. The issue occurs in the ff_mlz_decompression() function in libavcodec/mlz.c, where string codes beyond the dictionary's limit cause heap bytes to be copied into decoded audio output.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malformed MPEG-4 ALS files triggering uninitialized heap byte leaks in FFmpeg's mlz decompression. Detection requires analyzing audio files processed by FFmpeg versions up to 9.0.2 for unexpected output patterns or memory corruption signs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to leak sensitive data from memory, such as passwords or encryption keys, through audio output. This may lead to unauthorized information disclosure or further system compromise if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing personal or health data through memory leaks. Organizations processing such data must address this to maintain compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FFmpeg to the latest version beyond 9.0.2 to patch the mlz decompression flaw. Avoid processing untrusted MPEG-4 ALS files until patched. Monitor audio output for anomalies if using older versions.

Useful 0 Not Useful 0