FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.

Ein Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren oder offenzulegen, Sicherheitsmaßnahmen zu umgehen, Speicherbeschädigungen zu verursachen und möglicherweise beliebigen Code auszuführen.