Vulnerability · Published Aug 5, 2021 · Assigned by fedora
CVE-2021-3566
Medium 5.5
In plain English
A medium-severity information exposure in ffmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.9%top 40.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ffmpeg | 7:4.3-2 | DEBIAN-CVE-2021-3566 |
| Debian:13 | ffmpeg | 7:4.3-2 | DEBIAN-CVE-2021-3566 |
| Debian:14 | ffmpeg | 7:4.3-2 | DEBIAN-CVE-2021-3566 |
Affected products (as reported)
Weakness: CWE-200