PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6920 Ffmpeg CVE debrief

CVE-2016-6920 is a heap-based buffer overflow in FFmpeg’s EXR decoder path. The issue affects FFmpeg versions before 3.1.3 and can be triggered remotely through inputs involving tile positions, leading to an application crash and denial of service. NVD assigns a HIGH severity score (CVSS 3.0: 7.5) and classifies the weakness as CWE-119.

Vendor
Ffmpeg
Product
CVE-2016-6920
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Organizations that use FFmpeg to process OpenEXR or other untrusted media content should care most, especially services that accept user-supplied files, perform media transcoding, or expose FFmpeg in automated pipelines.

Technical summary

According to the CVE description, the vulnerability is a heap-based buffer overflow in decode_block within libavcodec/exr.c. NVD’s affected-version criteria mark FFmpeg through 3.1.2 as vulnerable, aligning with the description’s “before 3.1.3” boundary. The published CVSS vector indicates network attackability with no privileges or user interaction required, and the impact is availability loss rather than confidentiality or integrity damage.

Defensive priority

High for environments that ingest untrusted EXR/media files, because the flaw is remotely reachable and can crash the process without authentication or user interaction. Patch or upgrade should be prioritized ahead of routine maintenance for any exposed FFmpeg deployment.

Recommended defensive actions

  • Upgrade FFmpeg to 3.1.3 or a later fixed release.
  • Inventory applications, services, and libraries that bundle or dynamically link FFmpeg and verify their embedded version.
  • Restrict or sandbox media-processing components that handle untrusted files until patched.
  • Add file-type and size validation at ingestion points to reduce exposure to malformed inputs.
  • Monitor crash logs and service restarts in media-processing pipelines for signs of malformed EXR input handling.

Evidence notes

The supplied CVE description states: “Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3.” NVD lists affected CPE criteria through version 3.1.2 and rates the issue CVSS 3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). NVD also records CWE-119. Reference links in the record include the FFmpeg security page and an upstream commit reference, plus third-party advisories mirrored in the NVD entry.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-01-23. The NVD record was later modified on 2026-05-13; that modification date is not the original disclosure date.