CVE-2011-1931: sp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products,…

Unscored severity · published Jul 7, 2011

CVE-2011-1931

sp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products,…

–

CVSS

2.2%

EPSS

On KEV

Description

sp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products, performs a write operation outside the bounds of an unspecified array, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a malformed AMV file.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.2% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Ffmpeg · Ffmpeg

through 0.6.2; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +16 more · source: NVD

Libav · Libav

through 0.6.2; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +14 more · source: NVD