CVE-2020-22029: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slic...

Security readout for executives and security teams

FFmpeg 4.2 contains a heap-based buffer overflow in its color constancy video filter code. If an affected FFmpeg build processes malicious or unexpected media through that path, memory corruption could occur. The provided sources do not include CVSS, complete affected-version data, or confirmed active exploitation. Most relevant exposure is systems using FFmpeg 4.2, or downstream packages containing that vulnerable code, especially media-processing services handling untrusted files. Exposure is less clear where FFmpeg is unused, patched, or never reaches the color constancy filter path. Prioritize remediation where FFmpeg handles user-supplied media, because memory corruption in media parsers can affect service integrity. The urgency is constrained by incomplete severity data and no cited exploitation, so handle through normal vulnerability management unless exposed media-processing services are business-critical. Mitigation focus: Apply vendor-provided FFmpeg updates, including Debian guidance in DSA-4990 where applicable.; Check whether deployed FFmpeg source includes the referenced upstream fix commit.; Reduce processing of untrusted media by affected FFmpeg builds until patched..

Prepared

Jun 2, 2026, 19:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.