CVE-2017-14222: In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might...

Security readout for executives and security teams

CVE-2017-14222 is a denial-of-service issue in FFmpeg 3.3.3. A malformed MOV file can make FFmpeg consume excessive CPU and memory while parsing, potentially degrading or taking down services that process user-supplied media. Exposure is most likely where FFmpeg 3.3.3 or vulnerable downstream packages parse untrusted MOV media, such as upload pipelines, transcoding workers, thumbnailers, or security scanners. The provided affected-product metadata is incomplete, so package-level exposure must be confirmed locally. Treat this as medium priority for internet-facing or customer-upload media workflows. It is not described as code execution, but a reliable parser-level DoS can disrupt processing queues and dependent services if vulnerable FFmpeg builds handle untrusted files. Mitigation focus: Upgrade FFmpeg or distro packages to a release containing the upstream fix.; Apply Debian DSA-3996 updates where Debian packages are in use.; Restrict untrusted MOV processing until patched if service availability is critical..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.