Uninitialized Memory Disclosure in FFmpeg

Executive Summary

FFmpeg through version 9.0.2 has an uninitialized memory disclosure vulnerability in the function av_dynamic_hdr_plus_to_t35(). When the tone_mapping_flag is set to 0, up to three payload bytes remain uninitialized. Attackers can exploit this by providing specially crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata, causing remuxing or transcoding operations to write leaked process memory into output files.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FFmpeg versions and analyzing media files for uninitialized memory in metadata. Use 'ffmpeg -version' to verify if your version is affected. Inspect Matroska or HEVC/AV1 files with tools like 'ffprobe' for suspicious T.35 or SEI metadata blocks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to access sensitive information stored in memory by causing FFmpeg to include uninitialized memory contents in output files. This may lead to exposure of confidential data, such as credentials or personal information, depending on the context in which FFmpeg is used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, potentially violating GDPR, HIPAA, or other privacy regulations. Organizations using affected FFmpeg versions may face compliance risks due to potential data leaks in processed media files.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to the latest version beyond 9.0.2. Avoid processing untrusted media files with FFmpeg until patched. Monitor output files for unexpected data in metadata blocks.

Useful 0 Not Useful 0