Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the lower bound (qp < 0) but is missing upper bound validation. The qp value can reach 65 (base value 63 from 6-bit frame header + offset +2 from read_qp_offset) while the rv60_qp_to_idx array has size 64 (valid indices 0-63). This results in out-of-bounds array access at lines 1554 (decode_cbp8), 1655 (decode_cbp16), and 1419/1421 (get_c4x4_set), potentially leading to memory disclosure or crash. A previous fix in commit 61cbcaf93f added validation only for intra frames. This vulnerability affects the released versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20) and is fixed in git master commit 8abeb879df which will be included in FFmpeg 8.1.
{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavcodec-extra61",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavcodec61",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavdevice61",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavfilter-extra",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavfilter-extra10",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavfilter10",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavformat-extra",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavformat-extra61",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavformat61",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libavutil59",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libpostproc58",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libswresample5",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:7.1.1-1ubuntu4.2"
},
{
"binary_name": "libswscale8",
"binary_version": "7:7.1.1-1ubuntu4.2"
}
]
}{
"binaries": [
{
"binary_name": "libav-tools",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavcodec-extra-54",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavcodec54",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavdevice-extra-53",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavdevice53",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavfilter-extra-3",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavfilter3",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavformat-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavformat-extra-54",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavformat54",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavresample-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavresample1",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavutil-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavutil-extra-52",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libavutil52",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libswscale-dev",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libswscale-extra-2",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
},
{
"binary_name": "libswscale2",
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1"
}
]
}{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libav-tools",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavcodec-ffmpeg-extra56",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavcodec-ffmpeg56",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavdevice-ffmpeg56",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavfilter-ffmpeg5",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavformat-ffmpeg56",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavresample-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavresample-ffmpeg2",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libavutil-ffmpeg54",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libpostproc-ffmpeg53",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libswresample-ffmpeg1",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
},
{
"binary_name": "libswscale-ffmpeg3",
"binary_version": "7:2.8.17-0ubuntu0.1+esm14"
}
]
}{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-extra57",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec57",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavdevice57",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-extra",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-extra6",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter6",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavformat57",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavresample-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavresample3",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libavutil55",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libpostproc54",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libswresample2",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
},
{
"binary_name": "libswscale4",
"binary_version": "7:3.4.11-0ubuntu0.1+esm12"
}
]
}{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec-extra58",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavcodec58",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavdevice58",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-extra",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter-extra7",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavfilter7",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavformat58",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavresample-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavresample4",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libavutil56",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libpostproc55",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libswresample3",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
},
{
"binary_name": "libswscale5",
"binary_version": "7:4.2.7-0ubuntu0.1+esm12"
}
]
}{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavcodec-extra58",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavcodec58",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavdevice58",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavfilter-extra",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavfilter-extra7",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavfilter7",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavformat-extra",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavformat-extra58",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavformat58",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libavutil56",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libpostproc55",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libswresample3",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
},
{
"binary_name": "libswscale5",
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11"
}
]
}{
"binaries": [
{
"binary_name": "ffmpeg",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavcodec-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavcodec-extra",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavcodec-extra60",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavcodec60",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavdevice-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavdevice60",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavfilter-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavfilter-extra",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavfilter-extra9",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavfilter9",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavformat-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavformat-extra",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavformat-extra60",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavformat60",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavutil-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libavutil58",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libpostproc-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libpostproc57",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libswresample-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libswresample4",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libswscale-dev",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
},
{
"binary_name": "libswscale7",
"binary_version": "7:6.1.1-3ubuntu5+esm7"
}
]
}