1. Home
  2. CVE Database
  3. CVE-2023-39018
CRITICAL · 9.8

CVE-2023-39018

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argumen...

Vulnerability Description

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
BrampFfmpeg-Cli-Wrapper<= 0.7.0

Related Weaknesses (CWE)

CWE-94

References

FAQ

What is CVE-2023-39018?

CVE-2023-39018 is a vulnerability with a CVSS score of 9.8 (CRITICAL). FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argumen...

How severe is CVE-2023-39018?

CVE-2023-39018 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-39018?

Check the references section above for vendor advisories and patch information. Affected products include: Bramp Ffmpeg-Cli-Wrapper.