{"id":"CVE-2018-12460","details":"libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4, leading to a denial of service, related to idctdsp.c and mpegvideo.c.","modified":"2026-08-17T05:26:02.037813Z","published":"2018-06-15T15:29:00.327Z","references":[{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"},{"last_affected":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:4.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"}],"source":"CPE_STRING"}}],"versions":["4.0","n4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12460.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"},{"last_affected":"ace829cb45cff530b8a0aed6adf18f329d7a98f6"},{"fixed":"b3332a182f8ba33a34542e4a0370f38b914ccf7d"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:4.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.0","n4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12460.json","vanir_signatures_modified":"2026-08-17T05:26:02Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d","target":{"file":"libavcodec/mpegvideo.c"},"deprecated":false,"digest":{"line_hashes":["203287591705143062107314822259186818250","282324406643675235954044795659311484560","333694940045075628046426726534229330266","163351085974951288276078275623224076606"],"threshold":0.9},"id":"CVE-2018-12460-33b6afd3"},{"target":{"file":"libavcodec/idctdsp.c","function":"ff_idctdsp_init"},"deprecated":false,"digest":{"function_hash":"28671708147843153440469134798873711068","length":2672},"id":"CVE-2018-12460-35b548de","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d"},{"deprecated":false,"digest":{"line_hashes":["126536519982937281418884318443799011247","250889362032603908287582132871077149337","290159734777921403366208928525488705450","260773072982675090556546599099380073658"],"threshold":0.9},"id":"CVE-2018-12460-9110840e","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d","target":{"file":"libavcodec/idctdsp.c"}},{"id":"CVE-2018-12460-b8d9faf7","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d","target":{"file":"libavcodec/mpegvideo.c","function":"ff_mpv_idct_init"},"deprecated":false,"digest":{"function_hash":"39856762836001306115006842251816044728","length":750}},{"target":{"file":"libavcodec/idctdsp.h"},"deprecated":false,"digest":{"line_hashes":["130799097354866713191710292741187585976","256346152185321240798215610385516487639","73658507746507163792722605294300294903","73753474191504460849366634306293844425"],"threshold":0.9},"id":"CVE-2018-12460-f62ef0ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}