CVE-2009-0385: Canonical Ubuntu Linux

High severity, CVSS 9.3. EPSS: 6.7% chance of exploitation in the next 30 days.

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

Affected products

• Canonical Ubuntu Linux: version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only; version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 9 only; version 10 only
• Ffmpeg Ffmpeg: before 0.6.3 (fixed in 0.6.3)

Published 2009-02-02. Last modified 2026-06-16.