PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6920 Ffmpeg CVE debrief

CVE-2016-6920 is a heap-based buffer overflow in FFmpeg’s EXR decoder path. The issue affects FFmpeg versions before 3.1.3 and can be triggered remotely through inputs involving tile positions, leading to an application crash and denial of service. NVD assigns a HIGH severity score (CVSS 3.0: 7.5) and classifies the weakness as CWE-119.

Vendor
Ffmpeg
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Organizations that use FFmpeg to process OpenEXR or other untrusted media content should care most, especially services that accept user-supplied files, perform media transcoding, or expose FFmpeg in automated pipelines.

Technical summary

According to the CVE description, the vulnerability is a heap-based buffer overflow in decode_block within libavcodec/exr.c. NVD’s affected-version criteria mark FFmpeg through 3.1.2 as vulnerable, aligning with the description’s “before 3.1.3” boundary. The published CVSS vector indicates network attackability with no privileges or user interaction required, and the impact is availability loss rather than confidentiality or integrity damage.

Defensive priority

High for environments that ingest untrusted EXR/media files, because the flaw is remotely reachable and can crash the process without authentication or user interaction. Patch or upgrade should be prioritized ahead of routine maintenance for any exposed FFmpeg deployment.

Recommended defensive actions

  • Upgrade FFmpeg to 3.1.3 or a later fixed release.
  • Inventory applications, services, and libraries that bundle or dynamically link FFmpeg and verify their embedded version.
  • Restrict or sandbox media-processing components that handle untrusted files until patched.
  • Add file-type and size validation at ingestion points to reduce exposure to malformed inputs.
  • Monitor crash logs and service restarts in media-processing pipelines for signs of malformed EXR input handling.

Evidence notes

The supplied CVE description states: “Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3.” NVD lists affected CPE criteria through version 3.1.2 and rates the issue CVSS 3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). NVD also records CWE-119. Reference links in the record include the FFmpeg security page and an upstream commit reference, plus third-party advisories mirrored in the NVD entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6920 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6920

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6920 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6920

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.