CVE-2023-6602

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6602
A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2334338 Exploit Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2334338 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

20 Jun 2025, 18:46

Type Values Removed Values Added
First Time Ffmpeg ffmpeg
Ffmpeg
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
References () https://bugzilla.redhat.com/show_bug.cgi?id=2334338 - () https://bugzilla.redhat.com/show_bug.cgi?id=2334338 - Exploit, Third Party Advisory
Summary
  • (es) Se encontró una falla en FFmpeg's TTY Demuxer. Esta vulnerabilidad permite la posible exfiltración de datos mediante el análisis incorrecto de archivos de entrada que no cumplen con los requisitos TTY en las listas de reproducción HLS.

31 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-31 15:15

Updated : 2025-06-20 18:46

NVD link : CVE-2023-6602

Mitre link : CVE-2023-6602

CVE.ORG link : CVE-2023-6602

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

NVD-CWE-noinfo