CVE-2017-14169: Debian Linux
High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days.
In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.
Affected products
Published 2017-09-07. Last modified 2026-06-17.