CVE-2017-14055

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

31/08/2017

Last modified:

13/05/2026

Description

In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.

Impact

Vector 3.x

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): None
Availability (A): High

Base Score 3.x

6.50

Severity 3.x

MEDIUM

Vector 2.0

AV:N/AC:M/Au:N/C:N/I:N/A:C CVSS v2.0 Severity and Metrics:

Base Score: 7.10 HIGH
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Complete