{"id":"CVE-2018-12458","details":"An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.","modified":"2026-08-17T05:26:01.747482Z","published":"2018-06-15T15:29:00.217Z","related":["SUSE-SU-2018:3609-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}]}]},"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4249"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/6bbef938839adc55e8e048bc9cc2e0fafe2064df"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/e1182fac1afba92a4975917823a5f644bee7e6e8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"}],"database_specific":{"extracted_events":[{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"4.0"},{"last_affected":"4.0"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.0:*:*:*:*:*:*:*"]}}],"versions":["2.8","4.0","n4.0","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12458.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"},{"fixed":"6bbef938839adc55e8e048bc9cc2e0fafe2064df"},{"fixed":"e1182fac1afba92a4975917823a5f644bee7e6e8"}],"database_specific":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"4.0"},{"last_affected":"4.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.8","4.0","n4.0","n4.1-dev","n2.8.14","n2.8.13","n3.5-dev","n2.8.12","n3.4-dev","n2.8.11","n2.8.10","n2.8.9","n3.3-dev","n2.8.8","n2.8.7","n3.2-dev","n3.1-dev","n2.8.6","n2.8.5","n2.8.4","n2.8.3","n2.8.2","n2.8.1","n2.8","n2.9-dev","n2.8-dev"],"database_specific":{"vanir_signatures_modified":"2026-08-17T05:26:01Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["56833795360251818369765033581323091741","280404874225817245952846567227135081635","54896246386035839919929168273124326120","287697360365446967200998116568866649071"],"threshold":0.9},"id":"CVE-2018-12458-0c34ef7e","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/e1182fac1afba92a4975917823a5f644bee7e6e8","target":{"file":"libavcodec/mpeg4videoenc.c"}},{"id":"CVE-2018-12458-649dec09","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/6bbef938839adc55e8e048bc9cc2e0fafe2064df","target":{"file":"libavcodec/mpeg4videoenc.c"},"deprecated":false,"digest":{"line_hashes":["56833795360251818369765033581323091741","280404874225817245952846567227135081635","54896246386035839919929168273124326120","287697360365446967200998116568866649071"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12458.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}