CVE-2017-9994: libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and...

Security readout for executives and security teams

This issue affects older FFmpeg WebP decoding. A malicious media file could crash an application that processes it, causing denial of service. The public record also leaves room for unspecified other impact, but does not prove code execution or active exploitation. Exposure is most likely where affected FFmpeg versions decode WebP content, especially media upload, conversion, thumbnailing, scanning, or playback workflows that accept untrusted files. Downstream applications may be affected if they bundle or link vulnerable libavcodec builds. Treat as a practical availability risk for systems processing user-supplied media. Prioritize internet-facing or automated media pipelines first. Urgency is lower than confirmed exploited remote code execution, but old FFmpeg builds should be removed from production. Mitigation focus: Upgrade FFmpeg to 2.8.12, 3.0.8, 3.1.8, 3.2.5, 3.3.1, or later.; Apply distribution vendor updates, including Debian libav security updates where applicable.; Identify applications bundling FFmpeg or libavcodec and update those embedded copies..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.