CVE-2014-7937: Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome befor...

Security readout for executives and security teams

This is a media-parsing flaw in FFmpeg's Vorbis decoder, also noted in older Google Chrome builds. A malicious Vorbis I audio file could remotely crash affected software and may have had other unspecified effects. Business urgency depends on whether legacy FFmpeg or Chrome-era components still process untrusted media. Exposure is most likely in legacy systems, embedded products, or applications bundling FFmpeg/libavcodec before 2.4.2, or obsolete Chrome builds before 40.0.2214.91. Systems that accept or automatically process untrusted audio/media files deserve priority review. Treat as a targeted legacy remediation item. It is not supported as actively exploited in the provided sources, but untrusted media parsing is a high-risk surface and vulnerable versions are very old. Mitigation focus: Upgrade FFmpeg/libavcodec to 2.4.2 or later where applicable.; Upgrade Chrome to 40.0.2214.91 or later where applicable.; Apply relevant vendor distribution advisories for Ubuntu, Gentoo, SUSE, or Red Hat packages..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.