CVE-2017-11399: Ffmpeg

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.

Affected products

• Ffmpeg Ffmpeg: up to and including 3.3.2

Published 2017-07-17. Last modified 2026-06-17.