Integer Overflow in FFmpeg VP9 Superframe Handling

Executive Summary

This vulnerability is an integer overflow in FFmpeg version 9.0.2 or earlier. It occurs in the function cbs_vp9_split_fragment() within libavcodec/cbs_vp9.c during 32-bit builds. Attackers exploit this by sending a specially crafted VP9 packet with a manipulated superframe index containing frame sizes close to 2^32. This causes the size check to wrap around, leading to out-of-bounds memory reads that crash 32-bit applications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions for 9.0.2 or earlier. Check for crashes when processing VP9 video files. Use static analysis tools to examine cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c for improper superframe size handling.

Useful 0 Not Useful 0

Impact Analysis

If you use a 32-bit build of FFmpeg, this vulnerability could allow attackers to crash your applications by sending malicious VP9 video packets. This may lead to denial-of-service conditions, disrupting media processing tasks or services relying on FFmpeg for video handling.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes crashes in 32-bit applications due to out-of-bounds reads, which could lead to denial of service but does not directly expose or leak sensitive data. Compliance impact depends on system use: if the affected FFmpeg version processes media in environments handling regulated data (e.g., healthcare or personal data), crashes could disrupt operations but are unlikely to violate GDPR or HIPAA unless combined with other vulnerabilities that enable data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FFmpeg to a version later than 9.0.2 to address the integer overflow in cbs_vp9_split_fragment(). Avoid using 32-bit builds of FFmpeg as they are more vulnerable to this issue.

Useful 0 Not Useful 0