GCVE - cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*

part: a version: 3.2.1 update: *

Vendor	Ffmpeg (`4a8454a9-7e7a-5dff-9bf8-e8d1aa1a4a2f`)
Product	Ffmpeg (`69475a2d-e046-5b0f-b6da-299c42a85e87`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448402
`pkg:deb/ubuntu/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448404
`pkg:ffmpeg/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448405
`pkg:github/ffmpeg/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448407
`pkg:opensuse/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448408

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9996`	vulnerable	2026-06-08 05:10:20.230330	Details available The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. Published: 2017-06-28T06:00:00.000Z Updated: 2024-08-05T17:25:00.874Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378 http://www.securityfocus.com/bid/99323 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427 https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660 https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9991`	vulnerable	2026-06-08 05:10:20.216126	Details available Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Published: 2017-06-28T06:00:00.000Z Updated: 2024-08-05T17:25:00.371Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1399 http://www.securityfocus.com/bid/99316 https://github.com/FFmpeg/FFmpeg/commit/441026fcb13ac23aa10edc312bdacb6445a0ad06	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10192`	vulnerable	2026-06-08 05:07:17.555833	Details available Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size. Published: 2017-02-09T15:00:00.000Z Updated: 2024-08-06T03:14:42.542Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95991 https://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156 http://www.openwall.com/lists/oss-security/2017/01/31/12 http://www.openwall.com/lists/oss-security/2017/02/02/1 https://ffmpeg.org/security.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10191`	vulnerable	2026-06-08 05:07:17.555137	Details available Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches. Published: 2017-02-09T15:00:00.000Z Updated: 2024-08-06T03:14:42.828Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html http://www.securityfocus.com/bid/95989 http://www.openwall.com/lists/oss-security/2017/01/31/12 http://www.openwall.com/lists/oss-security/2017/02/02/1 https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10190`	vulnerable	2026-06-08 05:07:17.554333	Details available Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response. Published: 2017-02-09T15:00:00.000Z Updated: 2024-08-06T03:14:42.866Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html http://www.openwall.com/lists/oss-security/2017/01/31/12 http://www.openwall.com/lists/oss-security/2017/02/02/1 https://github.com/FFmpeg/FFmpeg/commit/2a05c8f813de6f2278827734bf8102291e7484aa https://trac.ffmpeg.org/ticket/5992	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.