CVE-2026-30997
Out-of-Bounds Read in FFmpeg AV1 Decoder Causes DoS
Publication date: 2026-04-13
Last updated on: 2026-04-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ffmpeg | ffmpeg | to 8.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read occurring in the read_global_param() function within the av1dec.c file of FFmpeg version 8.0.1. An out-of-bounds read means the program reads data outside the intended memory boundaries, which can lead to unexpected behavior.
Specifically, this flaw allows attackers to craft a malicious input that triggers this improper memory access.
The consequence of this vulnerability is a Denial of Service (DoS), meaning the affected software can crash or become unresponsive when processing the crafted input.
How can this vulnerability impact me? :
The primary impact of this vulnerability is that an attacker can cause a Denial of Service (DoS) on systems using FFmpeg version 8.0.1 by providing specially crafted input.
This means that applications or services relying on this version of FFmpeg for media processing could crash or stop functioning properly, potentially disrupting availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update FFmpeg to a version later than v8.0.1 where the out-of-bounds read in the read_global_param() function has been fixed.
Avoid processing untrusted or crafted input files with vulnerable versions of FFmpeg to prevent potential Denial of Service (DoS) attacks.