Heap Out-of-Bounds Write in FFmpeg Vulkan AV1 Decoder

Executive Summary

This vulnerability is a heap out-of-bounds write issue in FFmpeg versions 7.0 before 8.1.3 and 9.x before 9.0.2. It occurs in the vk_av1_decode_slice() function in libavcodec/vulkan_av1.c when processing AV1 video streams. The problem arises because the tile-count limit is only checked at the start, allowing attackers to provide a crafted stream with more than 256 tiles. This can overflow the tile_sizes buffer and corrupt heap memory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this flaw to execute arbitrary code or cause a denial of service by crashing the application. If FFmpeg is used in a media processing pipeline, this could lead to system compromise, data corruption, or service disruption. Users processing untrusted AV1 streams are at higher risk.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 8.1.3 or later if using version 7.0, or to version 9.0.2 or later if using version 9.x to address the heap out-of-bounds write vulnerability in vk_av1_decode_slice().

Useful 0 Not Useful 0