CVE-2023-6604

A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2334337	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

History

03 Nov 2025, 20:16

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html -

05 Aug 2025, 18:05

Type	Values Removed	Values Added
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2334337 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2334337 - Exploit, Issue Tracking, Third Party Advisory
CPE		cpe:2.3:a:ffmpeg:ffmpeg::::::::
Summary		(es) Se encontró un fallo en FFmpeg. Esta vulnerabilidad permite una carga de CPU adicional inesperada y un consumo de almacenamiento adicional, lo que puede provocar una degradación del rendimiento o la denegación del servicio mediante la demultiplexación de datos arbitrarios como datos con formato XBIN sin una validación de formato adecuada.
First Time		Ffmpeg ffmpeg Ffmpeg

06 Jan 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-06 17:15

Updated : 2025-11-03 20:16

NVD link : CVE-2023-6604

Mitre link : CVE-2023-6604

CVE.ORG link : CVE-2023-6604

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-6604", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-01-06T17:15:14.413", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334337", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-99"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en FFmpeg. Esta vulnerabilidad permite una carga de CPU adicional inesperada y un consumo de almacenamiento adicional, lo que puede provocar una degradaci\u00f3n del rendimiento o la denegaci\u00f3n del servicio mediante la demultiplexaci\u00f3n de datos arbitrarios como datos con formato XBIN sin una validaci\u00f3n de formato adecuada."}], "lastModified": "2025-11-03T20:16:07.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE670466-3267-48D2-A826-99B23F7FBD12", "versionEndIncluding": "6.0", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}