FFmpeg 9.0.2 Division by Zero in VVC Decoder

Executive Summary

FFmpeg through version 9.0.2 has a division by zero flaw in its VVC decoder. The issue occurs in the function ff_vvc_slice_rpl() when it fails to validate the num_ref_idx_active parameter against the built reference list entries. Attackers can exploit this by providing a specially crafted VVC bitstream that causes a zero POC difference in ff_vvc_mv_scale(), leading to a crash during decoding.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to FFmpeg's VVC decoder and may not have direct network detection methods. Monitor FFmpeg logs for crashes or errors during VVC file processing. Check for abnormal process termination when handling VVC streams.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash FFmpeg applications processing VVC video streams, potentially causing denial-of-service conditions. If exploited, it may disrupt media playback, transcoding, or other video processing tasks relying on FFmpeg's VVC decoder.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily causes a denial-of-service condition through a division by zero in FFmpeg's VVC decoder. However, if exploited in a system processing sensitive data, it could lead to service disruption, potentially affecting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to the latest version that patches this issue. Avoid processing untrusted VVC files until patched. Disable VVC decoding if not required. Monitor vendor advisories for patches.

Useful 0 Not Useful 0