Out-of-Bounds Read in FFmpeg ProRes 4444 Encoder

Executive Summary

This vulnerability is an out-of-bounds read issue in FFmpeg versions up to 9.0.2. It occurs in the prores_ks encoder's get_alpha_data() function when processing interlaced frames with odd heights. Attackers can exploit this by providing video files with alpha channels and odd heights encoded to interlaced ProRes 4444 format, causing the encoder to read memory outside the intended blocks buffer and include this out-of-bounds data in the output alpha plane.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited due to the vulnerability's low CVSS scores (2.0 v4.0, 2.5 v3.1). It requires local access and user interaction, making exploitation difficult. Successful exploitation could lead to information disclosure but does not allow code execution or privilege escalation. The primary risk is potential exposure of sensitive memory contents in video files.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the out-of-bounds read vulnerability in the prores_ks encoder.

Useful 0 Not Useful 0