{"id":"CVE-2019-9718","details":"In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.","modified":"2026-08-17T05:26:11.768574Z","published":"2019-03-12T09:29:00.530Z","related":["SUSE-SU-2019:3184-1","SUSE-SU-2019:3184-2"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"18.10"},{"last_affected":"18.10"},{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/107382"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2019/May/60"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3967-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4449"},{"type":"FIX","url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"340cea9f22c162e10d120835661e132721b7454b"},{"last_affected":"3c1ecb057d7621e57968624aa15ad3e9efc819f7"},{"fixed":"1f00c97bc3475c477f3c468cf2d924d5761d0982"}],"database_specific":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"4.1"},{"last_affected":"4.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.2","4.1","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9718.json","vanir_signatures_modified":"2026-08-17T05:26:11Z","vanir_signatures":[{"signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@1f00c97bc3475c477f3c468cf2d924d5761d0982","target":{"file":"libavcodec/htmlsubtitles.c","function":"ff_htmlmarkup_to_ass"},"deprecated":false,"digest":{"function_hash":"204917950801133920842422976060141113201","length":3748},"id":"CVE-2019-9718-02509bdd","signature_type":"Function"},{"digest":{"line_hashes":["34876112885775822493954399157375165520","310443000063906848339944236642136778273","268509660667405510217173691870110624948","237612654395964988526214551039992203642","302584550206105672938363029647922921173","191691833858206738579547090234815598181","256355226088922289758953209140190868235"],"threshold":0.9},"id":"CVE-2019-9718-0b9c30cc","signature_type":"Line","signature_version":"v1","source":"https://git.ffmpeg.org/ffmpeg.git@1f00c97bc3475c477f3c468cf2d924d5761d0982","target":{"file":"libavcodec/htmlsubtitles.c"},"deprecated":false}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"340cea9f22c162e10d120835661e132721b7454b"},{"last_affected":"3c1ecb057d7621e57968624aa15ad3e9efc819f7"},{"fixed":"23ccf3cabb4baf6e8af4b1af3fcc59c904736f21"}],"database_specific":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"4.1"},{"last_affected":"4.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.2","4.1","n3.2.13","n3.2.12","n3.2.11","n4.1-dev","n3.2.10","n3.2.9","n3.5-dev","n3.2.8","n3.2.7","n3.2.6","n3.2.5","n3.4-dev","n3.2.4","n3.2.3","n3.2.2","n3.2.1","n3.2","n3.3-dev","n3.2-dev"],"database_specific":{"vanir_signatures_modified":"2026-08-17T05:26:11Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"134429341697870814247987316111924007456","length":3632},"id":"CVE-2019-9718-755ab778","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21","target":{"file":"libavcodec/htmlsubtitles.c","function":"ff_htmlmarkup_to_ass"}},{"source":"https://github.com/ffmpeg/ffmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21","target":{"file":"libavcodec/htmlsubtitles.c"},"deprecated":false,"digest":{"line_hashes":["146229409084369695006291932218330531278","186871920662715219977446106701134555870","310562769026243982809424482522257025845","34344457376983665913898773828430549216","260166848363255873671710857472511837215","80024346695892532889397988976103392180","202968329324838149850240999019982554458"],"threshold":0.9},"id":"CVE-2019-9718-da1a4911","signature_type":"Line","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9718.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}