CVE-2017-9994: Debian Linux

High severity, CVSS 7.8. EPSS: 1.8% chance of exploitation in the next 30 days.

libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.

Affected products

• Debian Debian Linux: version 8.0 only
• Ffmpeg Ffmpeg: before 2.8.12 (fixed in 2.8.12); from 3.0, before 3.0.8 (fixed in 3.0.8); from 3.1, before 3.1.8 (fixed in 3.1.8); from 3.2, before 3.2.5 (fixed in 3.2.5); from 3.3, before 3.3.1 (fixed in 3.3.1)

Published 2017-06-28. Last modified 2026-06-17.