PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9826 Libav CVE debrief

CVE-2016-9826 is a denial-of-service issue in libav 11.8. NVD says libavcodec/ituh263dec.c can crash when it performs a left shift on a negative value, which is undefined behavior and can terminate the application. The public NVD record classifies the issue as medium severity and maps it to CWE-189 (Numeric Errors).

Vendor
Libav
Product
CVE-2016-9826
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Teams that use libav 11.8 to decode or process media, especially systems that handle untrusted H.263 content and need high availability.

Technical summary

The vulnerable path is in libavcodec/ituh263dec.c. A left shift applied to a negative value can trigger undefined behavior and a crash. NVD lists the affected CPE as libav 11.8 and assigns CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact without confidentiality or integrity impact.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade libav to a version that includes a fix, if one is available from the vendor.
  • If upgrading is not immediately possible, limit exposure by avoiding untrusted media inputs and isolating decoding workloads.
  • Run affected processing in a constrained sandbox or container to reduce the blast radius of a crash.
  • Monitor for decoder crashes and treat repeated failures as a sign of potentially malicious or malformed input.

Evidence notes

The NVD record and CVE description both point to libav 11.8 and a crash in libavcodec/ituh263dec.c caused by left shifting a negative value. NVD assigns CWE-189 and CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The textual description says "remote attackers," while the CVSS vector indicates local attack conditions with user interaction; treat exploitability assumptions cautiously and rely on the record's stated vector when prioritizing.

Official resources

Publicly disclosed in the CVE record on 2017-03-01 and later modified by NVD on 2026-05-13.