{"id":"CVE-2018-7557","details":"The decode_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of array read) via an AVI file with crafted dimensions within chroma subsampling data.","modified":"2026-08-17T05:26:20.248729Z","published":"2018-02-28T07:29:00.463Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202003-65"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4249"},{"type":"FIX","url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/7414d0bda7763f9bd69c26c068e482ab297c1c96"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/e724bd1dd9efea3abb8586d6644ec07694afceae"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"6a97ba521558ce131fe839eed2d51ff745280e1d"},{"fixed":"7414d0bda7763f9bd69c26c068e482ab297c1c96"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.8"},{"last_affected":"3.4.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["n3.4.2","n3.4.1","n3.4","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev"],"database_specific":{"vanir_signatures_modified":"2026-08-17T05:26:20Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["214294340827385027346326899809308912278","319967151764465081227513198959321650619","160860407430123656188533758835378100984","88426036291747426103396839917112951526","322060800242239300558022628811003160243","264994763499980366517533028970536454039","15401177006481919119583342312789940116","218511901579334236097636589891628169652","54072751883247017626672728946603888412","334816836273630641830478390641941193451"],"threshold":0.9},"id":"CVE-2018-7557-09358d33","signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@7414d0bda7763f9bd69c26c068e482ab297c1c96","target":{"file":"libavcodec/utvideodec.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@7414d0bda7763f9bd69c26c068e482ab297c1c96","target":{"file":"libavcodec/utvideodec.c","function":"decode_init"},"deprecated":false,"digest":{"function_hash":"50909752490920241215824309361052532218","length":4482},"id":"CVE-2018-7557-924bac71"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7557.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"6a97ba521558ce131fe839eed2d51ff745280e1d"},{"fixed":"e724bd1dd9efea3abb8586d6644ec07694afceae"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.8"},{"last_affected":"3.4.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["n2.8.14","n3.4.2","n2.8.13","n3.4.1","n3.4","n2.8.12","n3.4-dev","n2.8.11","n2.8.10","n2.8.9","n3.3-dev","n2.8.8","n2.8.7","n3.2-dev","n3.1-dev","n2.8.6","n2.8.5","n2.8.4","n2.8.3","n2.8.2","n2.8.1","n2.8","n2.9-dev","n2.8-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7557.json","vanir_signatures_modified":"2026-08-17T05:26:20Z","vanir_signatures":[{"digest":{"function_hash":"261170408201920726981716170408581999831","length":2014},"id":"CVE-2018-7557-c58f81bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/e724bd1dd9efea3abb8586d6644ec07694afceae","target":{"file":"libavcodec/utvideodec.c","function":"decode_init"},"deprecated":false},{"id":"CVE-2018-7557-e1a439bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/e724bd1dd9efea3abb8586d6644ec07694afceae","target":{"file":"libavcodec/utvideodec.c"},"deprecated":false,"digest":{"line_hashes":["214294340827385027346326899809308912278","319967151764465081227513198959321650619","160860407430123656188533758835378100984","88426036291747426103396839917112951526","322060800242239300558022628811003160243","294584906807958280719769276673771155382","173453050150287002342984267387285969060","28682244462948592149093618534071984159","105041463035589690360197019114153569694","112286002592890528022285994238400706647"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}