CVE-2017-9995: libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows...

Security readout for executives and security teams

This is an FFmpeg media parsing flaw. A specially crafted file can crash software that processes it, creating denial-of-service risk for services, workflows, or desktop tools that ingest untrusted media. The sources mention possible unspecified other impact, but do not establish code execution or active exploitation. Exposure is most likely where FFmpeg 3.3 is used to decode, transcode, preview, scan, or otherwise process externally supplied media files. Risk is lower where media input is trusted or FFmpeg is not present. Treat as a targeted remediation item for media-processing systems, not an emergency internet-wide exposure based on the supplied evidence. Prioritize public upload, transcoding, preview, and malware-scanning workflows that parse untrusted media. Mitigation focus: Upgrade FFmpeg 3.3 deployments to 3.3.1 or a later vendor-supported build.; Update applications or appliances that bundle vulnerable FFmpeg versions.; Restrict processing of untrusted media until affected components are updated..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.