PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9823 Libav CVE debrief

CVE-2016-9823 was published on 2017-03-01 and describes a denial-of-service condition in Libav 11.8. According to the CVE record, libavcodec/x86/mpegvideo.c can be crashed by a crafted file. NVD classifies the issue as medium severity and maps it to CWE-119, with the availability impact rated high.

Vendor
Libav
Product
CVE-2016-9823
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Administrators, package maintainers, and application owners who still use Libav 11.8 or derivatives that include the affected libavcodec/x86/mpegvideo.c code path should care, especially where untrusted media files are processed.

Technical summary

The supplied NVD record identifies libav:libav 11.8 as vulnerable and labels the weakness CWE-119. The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating a crash-oriented availability impact rather than confidentiality or integrity impact. The vulnerability description says a crafted file can trigger a denial of service in libavcodec/x86/mpegvideo.c. The reference set includes a SecurityFocus BID entry and a Gentoo blog post documenting multiple crash conditions in Libav.

Defensive priority

Medium. Prioritize remediation if Libav is present in services that ingest untrusted media or where a process crash would interrupt availability.

Recommended defensive actions

  • Inventory systems and applications that ship or embed Libav 11.8.
  • Upgrade to a vendor-fixed or newer build that includes the relevant libavcodec/x86/mpegvideo.c remediation.
  • If upgrading is not immediately possible, backport the upstream or vendor fix into the pinned package build.
  • Reduce exposure by limiting untrusted media ingestion and running media parsing workloads in a constrained, isolated process.
  • Monitor for crash reports or abnormal termination in components that decode or transcode media using Libav.
  • Retire unsupported Libav 11.8 deployments where practical.

Evidence notes

The official NVD record lists cpe:2.3:a:libav:libav:11.8:*:*:*:*:*:*:* as vulnerable and assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H with CWE-119. The CVE description states that libavcodec/x86/mpegvideo.c in Libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file. Supplied references include a SecurityFocus BID 94732 entry and a Gentoo blog post titled 'libav multiple crashes from the undefined behavior sanitizer,' which is tagged as Exploit and Third Party Advisory.

Official resources

The CVE was published on 2017-03-01. The supplied NVD record was modified on 2026-05-13, which reflects record maintenance rather than the original vulnerability disclosure date.