Heap Buffer Overflow in FFmpeg via OpenEXR RLE Encoding

Executive Summary

This vulnerability is a heap buffer overflow in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/exrenc.c component when processing frames taller than the encoder height. Attackers can exploit this by providing input with a resolution that increases mid-stream, which is then transcoded to OpenEXR with RLE compression. This causes the application to write pointers past the scanline array, leading to heap memory corruption and potential crashes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the FFmpeg version in use. If you are running FFmpeg through version 9.0.2, you may be affected. Run 'ffmpeg -version' to check the installed version. Additionally, monitor for crashes during OpenEXR encoding with RLE compression, especially when processing frames with dynamic height changes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash the FFmpeg application, potentially leading to denial-of-service conditions. If exploited successfully, it may also enable arbitrary code execution, depending on the system's memory layout and protections. Users processing media files with FFmpeg are at risk if they handle crafted input files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory corruption or crashes during media processing. If exploited, it may lead to data integrity issues or denial-of-service, which could violate confidentiality or availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FFmpeg to the latest patched version. Avoid processing OpenEXR files with RLE compression from untrusted sources. If updating is not possible, disable RLE compression in OpenEXR encoding or restrict FFmpeg to trusted input files.

Useful 0 Not Useful 0