CVE-2015-3395: The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2....

Security readout for executives and security teams

CVE-2015-3395 is a media-decoding flaw in older Libav and FFmpeg versions. A maliciously crafted image could trigger an out-of-bounds array access while decoding MS RLE palette data. The supplied sources do not define the final impact, so treat this as a legacy media-processing risk where untrusted uploads are handled. Exposure is most likely where legacy FFmpeg or Libav processes untrusted images or media, such as upload pipelines, transcoding services, desktop previewers, or automated ingestion systems. The provided affected-product metadata is incomplete, but the CVE description names affected Libav and FFmpeg release ranges. Prioritize remediation for systems that automatically process external media. For isolated endpoints or trusted-only workflows, handle through normal legacy dependency patching. The uncertainty around impact argues for removal of vulnerable versions, not emergency response absent exposure evidence. Mitigation focus: Upgrade Libav beyond 10.7 or 11.4, as applicable.; Upgrade FFmpeg beyond the fixed branch versions named in the CVE.; Apply Debian, Ubuntu, or Gentoo security updates where those packages are managed by the OS..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.