NULL Pointer Dereference in FFmpeg Causes Denial of Service

Executive Summary

This is a NULL pointer dereference vulnerability in FFmpeg's get_min_buffer_size function located in /libswscale/slice.c. It allows attackers to cause a Denial of Service by providing a specially crafted video file that triggers the flaw.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a NULL pointer dereference in FFmpeg's get_min_buffer_size function, which can be triggered by a crafted video file. To detect it, monitor for crashes or hangs when processing video files with FFmpeg. Use tools like ffprobe or ffplay to test suspicious files. Check system logs for segmentation faults or application crashes during media processing.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could cause applications using FFmpeg to crash or become unresponsive when processing malicious video files, leading to service disruption or application failure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service via NULL pointer dereference, which may disrupt system availability. Compliance impact depends on system role; GDPR requires availability safeguards (Article 32), while HIPAA mandates access controls and availability (45 CFR §164.312). A DoS could violate these if critical systems are affected.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to the latest stable version to patch the NULL pointer dereference in get_min_buffer_size. Avoid processing untrusted video files until patched.

Useful 0 Not Useful 0