CVE-2020-12284

CRITICAL 9.8CVE-2020-12284 · Published 28/04/2020 · updated 17/06/2026

In short

CVE-2020-12284 is a CRITICAL (CVSS 9.8) vulnerability affecting ffmpeg (ffmpeg).
Chance of exploitation in the next 30 days (EPSS): 3.9%, higher than 90.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ffmpeg ffmpeg	`= 4.1= 4.2.2`	No fix yet

Description

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

References

bugs.chromium.org/p/oss-fuzz/issues/detail · Exploit
FFmpeg/FFmpeg commit 1812352 · Patch
FFmpeg/FFmpeg commit a3a3730 · Patch
security.gentoo.org/glsa/202007-58 · Third Party Advisory
usn.ubuntu.com/4431-1 · Third Party Advisory
debian.org/security/2020/dsa-4722 · Third Party Advisory

More vulnerabilities in ffmpeg

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ffmpeg

= 4.1= 4.2.2

No fix yet

More vulnerabilities in ffmpeg

See all →