Description

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T20:17:02.920Z",
  "pubdate": "2026-09-14T20:17:02.920Z",
  "executiveSummary": "A critical out-of-bounds (OOB) read vulnerability exists within the Convolution Filter component of FFmpeg, specifically impacting the setup_3x3 function in libavfilter/vf_convolution.c.\nThis vulnerability is classified as an out-of-bounds read, potentially allowing remote attackers to trigger memory access violations.\nThe flaw affects FFmpeg versions up to 4.4.6, 5.1.8, 6.1.4, 7.1.3, and 8.0.1.\nThe risk implication is significant, as the vulnerability is susceptible to remote exploitation using publicly disclosed methods.\nSuccessful exploitation may result in information disclosure or application crashes, impacting system availability and security.\nThe attack can be performed remotely, requiring no user-provided authentication, which heightens the urgency for remediation via vendor-supplied patches.",
  "technicalDetails": "The vulnerability resides within the setup_3x3 function, defined in the source file libavfilter/vf_convolution.c, which is responsible for configuring kernel matrix parameters for image convolution processing.\nThe root cause is an improper bounds check during the initialization or processing of the 3x3 convolution kernel. When the Convolution Filter receives malformed input or specially crafted media streams that trigger specific execution paths within setup_3x3, the internal logic fails to validate index offsets or buffer dimensions before accessing memory.\nSpecifically, the implementation of the convolution matrix setup lacks sufficient boundary verification, leading the function to read data from memory addresses outside the designated buffer boundaries.\nThe attack flow commences when an attacker provides a maliciously crafted video or image file to an application utilizing the affected FFmpeg library. As the application attempts to decode or process this file using the Convolution Filter, the malformed parameters are passed to setup_3x3.\nDuring execution, the function performs pointer arithmetic or indexing operations based on the input parameters without strictly enforcing buffer size constraints. This allows the attacker to influence the read operation, causing the application to access adjacent memory segments.\nAs a result of this OOB read, the application may inadvertently leak sensitive data stored in adjacent memory regions into the output processed stream or cause an immediate crash due to illegal memory access (Segmentation Fault).\nThis vulnerability is exploitable remotely, requiring no elevated privileges or direct authentication on the target system. Because the exploit vector has been publicly disclosed, the probability of active exploitation in environments using older, unpatched FFmpeg versions is high.\nThe patch identified as 8970658472/e24b9820b4 addresses this issue by implementing rigorous validation of the kernel parameters and ensuring that all memory access operations within setup_3x3 are strictly contained within their allocated buffers.\nAffected versions include all releases up to 4.4.6, 5.1.8, 6.1.4, 7.1.3, and 8.0.1. Systems relying on FFmpeg for media transcoding, processing, or playback are inherently exposed until the library is updated to the corrected versions (4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1, or 9.0)."
}