CVE-2015-8217: The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma...

Security readout for executives and security teams

CVE-2015-8217 is an FFmpeg HEVC parsing flaw fixed after versions before 2.8.2. A crafted video stream could crash vulnerable processing components through an out-of-bounds array access. Business urgency depends on whether your services ingest untrusted HEVC media, such as uploads, transcoding queues, or automated media inspection. Exposure is most likely where FFmpeg or downstream libav/FFmpeg packages process untrusted HEVC content. Public upload pipelines, media converters, thumbnailers, and messaging or storage systems that auto-parse videos are higher concern. Systems not handling HEVC or only processing trusted files have lower practical exposure. Prioritize patching on internet-facing or automated media-processing systems. This is not KEV-listed and lacks scored severity in the supplied data, but crafted media can disrupt services that depend on FFmpeg parsing availability. Mitigation focus: Upgrade FFmpeg to 2.8.2 or later where directly managed.; Apply vendor libav or FFmpeg security updates for packaged distributions.; Restrict untrusted HEVC processing until patched..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.