CVE-2017-9992: Debian Linux

High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Affected products

• Debian Debian Linux: version 8.0 only
• Ffmpeg Ffmpeg: before 2.8.12 (fixed in 2.8.12); from 3.0, before 3.0.8 (fixed in 3.0.8); from 3.1, before 3.1.8 (fixed in 3.1.8); from 3.2, before 3.2.5 (fixed in 3.2.5); from 3.3, before 3.3.1 (fixed in 3.3.1)

Published 2017-06-28. Last modified 2026-06-17.