Heap Buffer Overflow in FFmpeg LCEVC Decoder

Executive Summary

FFmpeg through version 9.0.2 has a heap buffer overflow in libavcodec/lcevcdec.c. The issue occurs because LCEVC output picture dimensions are not checked against the allocated frame size. Attackers can exploit this by embedding specially crafted LCEVC enhancement data with mismatched global configurations in H.264 or HEVC video streams, leading to heap memory corruption in affected decoding applications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FFmpeg version is 9.0.2 or earlier. Run `ffmpeg -version` to see the installed version. If vulnerable, update to a patched version. Monitor for crashes or memory corruption during video processing, especially with H.264 or HEVC streams containing LCEVC enhancement data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code or cause denial-of-service conditions on systems running vulnerable FFmpeg versions. Users processing untrusted media files, especially those with LCEVC enhancement data, may experience crashes, data corruption, or potential remote code execution if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption in applications processing video streams. Exploitation may lead to unauthorized data access, modification, or denial of service, which could violate data integrity and confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the heap buffer overflow in libavcodec/lcevcdec.c. Avoid processing untrusted media files, especially those with embedded LCEVC enhancement data, until patched.

Useful 0 Not Useful 0