01 Record

CVE-2019-12730

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 3.05% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 87.1% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-06-04 13:14Z7 YR AGO

Last updated

2024-08-04 23:32Z2 YR AGO

Reserved

2019-06-04

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-908Use of Uninitialized ResourceBase

Data version

5.1

Document digest

ae9000d3ad5e073c49451e11024e117ff260b07fdb41df57bcb9d4784d5324fb

05 Affected products

VendorProductVersionsPlatforms

ffmpegffmpegNot specified—

06 References

github.comhttps://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014bx_refsource_MISC
github.comhttps://github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40x_refsource_MISC
git.ffmpeg.orghttps://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4x_refsource_CONFIRM
git.ffmpeg.orghttps://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2x_refsource_CONFIRM
www.securityfocus.com109317http://www.securityfocus.com/bid/109317vdb-entryx_refsource_BID
seclists.org20190816 [SECURITY] [DSA 4502-1] ffmpeg security updatehttps://seclists.org/bugtraq/2019/Aug/30mailing-listx_refsource_BUGTRAQ
www.debian.orgDSA-4502https://www.debian.org/security/2019/dsa-4502vendor-advisoryx_refsource_DEBIAN
security.gentoo.orgGLSA-202003-65https://security.gentoo.org/glsa/202003-65vendor-advisoryx_refsource_GENTOO
usn.ubuntu.comUSN-4431-1https://usn.ubuntu.com/4431-1/vendor-advisoryx_refsource_UBUNTU

07 Fixed in

Debian 12

ffmpeg
Fixed in 7:4.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

ffmpeg
Fixed in 7:4.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

ffmpeg
Fixed in 7:4.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

ffmpeg
Fixed in 7:2.8.17-0ubuntu0.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

ffmpeg
Fixed in 7:3.4.8-0ubuntu0.2

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.