PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9823 Libav CVE debrief

CVE-2016-9823 was published on 2017-03-01 and describes a denial-of-service condition in Libav 11.8. According to the CVE record, libavcodec/x86/mpegvideo.c can be crashed by a crafted file. NVD classifies the issue as medium severity and maps it to CWE-119, with the availability impact rated high.

Vendor
Libav
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Administrators, package maintainers, and application owners who still use Libav 11.8 or derivatives that include the affected libavcodec/x86/mpegvideo.c code path should care, especially where untrusted media files are processed.

Technical summary

The supplied NVD record identifies libav:libav 11.8 as vulnerable and labels the weakness CWE-119. The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating a crash-oriented availability impact rather than confidentiality or integrity impact. The vulnerability description says a crafted file can trigger a denial of service in libavcodec/x86/mpegvideo.c. The reference set includes a SecurityFocus BID entry and a Gentoo blog post documenting multiple crash conditions in Libav.

Defensive priority

Medium. Prioritize remediation if Libav is present in services that ingest untrusted media or where a process crash would interrupt availability.

Recommended defensive actions

  • Inventory systems and applications that ship or embed Libav 11.8.
  • Upgrade to a vendor-fixed or newer build that includes the relevant libavcodec/x86/mpegvideo.c remediation.
  • If upgrading is not immediately possible, backport the upstream or vendor fix into the pinned package build.
  • Reduce exposure by limiting untrusted media ingestion and running media parsing workloads in a constrained, isolated process.
  • Monitor for crash reports or abnormal termination in components that decode or transcode media using Libav.
  • Retire unsupported Libav 11.8 deployments where practical.

Evidence notes

The official NVD record lists cpe:2.3:a:libav:libav:11.8:*:*:*:*:*:*:* as vulnerable and assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H with CWE-119. The CVE description states that libavcodec/x86/mpegvideo.c in Libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file. Supplied references include a SecurityFocus BID 94732 entry and a Gentoo blog post titled 'libav multiple crashes from the undefined behavior sanitizer,' which is tagged as Exploit and Third Party Advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9823 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9823

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9823 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9823

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.