CVE-2016-7562: The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cau...

Security readout for executives and security teams

CVE-2016-7562 is a denial-of-service issue in FFmpeg before 3.1.4. A crafted AVI file can trigger a buffer overflow during media decoding, potentially crashing services that process untrusted video. The available sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in applications, appliances, containers, or workflows that use FFmpeg before 3.1.4 to parse uploaded, emailed, scraped, or otherwise untrusted AVI files. Systems that only process trusted media or use vendor-backported fixed packages have lower exposure. Prioritize remediation for internet-facing or customer-facing media processing systems, especially upload and transcoding services. For internal systems with trusted media only, handle through normal patch cycles. The business risk is service disruption, with limited public evidence for broader compromise. Mitigation focus: Inventory applications and services that bundle or invoke FFmpeg.; Upgrade FFmpeg according to vendor guidance; sources identify versions before 3.1.4 as vulnerable.; Apply distribution security updates, including Gentoo guidance where relevant..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.