Technical impact
An out‑of‑bounds read in FFmpeg’s AV1 decoder (read_global_param() in libavcodec/av1dec.c) allows an attacker to craft a malicious input that causes the decoder to read memory beyond the intended bounds and crash. The flaw produces a denial of service; it does not enable arbitrary code execution or data disclosure. It falls under CWE‑125 (Out‑of‑bounds Read) and CWE‑1285 (Improper Handling of External Input). The likely attack vector is the delivery of a specially crafted AV1 stream to any application that decodes such media with FFmpeg 8.0.1.
Affected Systems
This vulnerability affects FFmpeg version 8.0.1, the implementation of the AV1 decoder in libavcodec/av1dec.c. No vendor or product names are listed in the CNA data, so users of any application that relies on FFmpeg 8.0.1 for AV1 decoding are potentially impacted. Versions prior to 8.0.1 and later releases have not been confirmed to be affected.
Risk and Exploitability
The CVSS base score of 7.5 indicates a high severity and suggests that remote exploitation is possible through the controlled delivery of malicious input. No EPSS value is available and the flaw is not included in CISA’s KEV catalog, implying no widely reported exploitation to date. An attacker would need to supply the crafted AV1 file to the decoder, which can be achieved by transmitting the file over a network or embedding it in media that the application processes. Because the issue triggers a crash instead of arbitrary code execution, the damage is limited to service disruption rather than broader compromise.
Debian DSA