Heap Overflow in FFmpeg Nellymoser Encoding

Executive Summary

This is an off-by-one heap overflow in FFmpeg 9.0.2. It occurs in the get_exponent_dynamic() function within libavcodec/nellymoserenc.c when encoding Nellymoser audio with trellis enabled. Attackers can exploit this by providing crafted audio, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FFmpeg version is 9.0.2 or earlier. Run 'ffmpeg -version' to verify the installed version. If vulnerable, update to a patched version immediately.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code or cause denial of service by corrupting heap memory. It requires user interaction (supplying crafted audio) and local access, but could lead to data breaches, system crashes, or privilege escalation if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution or information disclosure, which may violate data protection requirements under GDPR (e.g., integrity and confidentiality of personal data) and HIPAA (e.g., unauthorized access to protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the off-by-one heap overflow in get_exponent_dynamic(). Disable trellis encoding in Nellymoser if possible until patched. Monitor for suspicious audio processing activities.

Useful 0 Not Useful 0