CVE-2019-17539: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Ffmpeg Ffmpeg: before 3.4.7 (fixed in 3.4.7); from 4.0, before 4.0.5 (fixed in 4.0.5); from 4.1, before 4.1.5 (fixed in 4.1.5)

Published 2019-10-14. Last modified 2026-06-17.