CVE-2009-4631: Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of serv...

Security readout for executives and security teams

CVE-2009-4631 affects the VP3 decoder in FFmpeg 0.5. A malicious VP3 media file could crash software that processes it, and the CVE notes possible arbitrary code execution through memory corruption. Business urgency depends on whether legacy FFmpeg 0.5, or packages derived from it, still handle untrusted media. Exposure is most likely in old media-processing services, desktop applications, or embedded products that include FFmpeg 0.5 and decode user-supplied VP3 files. Modern systems are less likely affected, but long-lived appliances and bundled libraries should be checked. Treat this as a legacy exposure issue. It is not currently evidenced as actively exploited, but any remaining FFmpeg 0.5 deployment processing external media should be remediated because media parsers are common attack surfaces. Mitigation focus: Inventory FFmpeg versions in servers, workstations, containers, appliances, and bundled application libraries.; Replace FFmpeg 0.5 with vendor-supported packages following FFmpeg or distribution security guidance.; Check Debian DSA-2000 if managing Debian-derived systems from that era..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.