CVE-2019-1000016 Denial of service in n/a

Medium 6.5 Published 4 Feb 2019 Updated 5 Aug 2024

A specially crafted AV1 file can cause a denial of service in FFmpeg due to improper array index validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1000016?

CVE-2019-1000016 is a medium-severity denial of service vulnerability in Ffmpeg Ffmpeg, published on 4 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.

Weakness: CWE-129

Which versions are affected by CVE-2019-1000016?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2019-1000016?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-1000016 being exploited?

There is no known exploitation of CVE-2019-1000016 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as CLEANSTART-2024-DU40050, DEBIAN-CVE-2019-1000016, GHSA-hc9w-x35j-3w9c, JLSEC-2025-101.