CVE-2017-9993

—

CVSS 3.0

7.5 high

EPSS

16%p97

Published

Jun 28, 2017 (Jun 28, 2017)

Modified

Jun 17, 2026

Description

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.

Vendors: ffmpeg debian
Products: ffmpeg, debian linux
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (16.4%)

In the news0 stories

No ingested article mentions this CVE yet.