Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the lower bound (qp < 0) but is missing upper bound validation. The qp value can reach 65 (base value 63 from 6-bit frame header + offset +2 from readqpoffset) while the rv60qptoidx array has size 64 (valid indices 0-63). This results in out-of-bounds array access at lines 1554 (decodecbp8), 1655 (decodecbp16), and 1419/1421 (getc4x4_set), potentially leading to memory disclosure or crash. A previous fix in commit 61cbcaf93f added validation only for intra frames. This vulnerability affects the released versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20) and is fixed in git master commit 8abeb879df which will be included in FFmpeg 8.1.
{
"binaries": [
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavcodec-extra61"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavcodec61"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavdevice61"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavfilter-extra"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavfilter-extra10"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavfilter10"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavformat-extra"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavformat-extra61"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavformat61"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libavutil59"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libpostproc58"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libswresample5"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:7.1.1-1ubuntu4.2",
"binary_name": "libswscale8"
}
]
}{
"binaries": [
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libav-tools"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavcodec-extra-54"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavcodec54"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavdevice-extra-53"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavdevice53"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavfilter-extra-3"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavfilter3"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavformat-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavformat-extra-54"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavformat54"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavresample-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavresample1"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavutil-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavutil-extra-52"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libavutil52"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libswscale-dev"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libswscale-extra-2"
},
{
"binary_version": "6:9.20-0ubuntu0.14.04.1+esm1",
"binary_name": "libswscale2"
}
]
}{
"binaries": [
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libav-tools"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavcodec-ffmpeg-extra56"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavcodec-ffmpeg56"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavdevice-ffmpeg56"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavfilter-ffmpeg5"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavformat-ffmpeg56"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavresample-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavresample-ffmpeg2"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libavutil-ffmpeg54"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libpostproc-ffmpeg53"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libswresample-ffmpeg1"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:2.8.17-0ubuntu0.1+esm14",
"binary_name": "libswscale-ffmpeg3"
}
]
}{
"binaries": [
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavcodec-extra57"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavcodec57"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavdevice57"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavfilter-extra"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavfilter-extra6"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavfilter6"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavformat57"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavresample-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavresample3"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libavutil55"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libpostproc54"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libswresample2"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:3.4.11-0ubuntu0.1+esm12",
"binary_name": "libswscale4"
}
]
}{
"binaries": [
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavcodec-extra58"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavcodec58"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavdevice58"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavfilter-extra"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavfilter-extra7"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavfilter7"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavformat58"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavresample-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavresample4"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libavutil56"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libpostproc55"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libswresample3"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:4.2.7-0ubuntu0.1+esm12",
"binary_name": "libswscale5"
}
]
}{
"binaries": [
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavcodec-extra58"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavcodec58"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavdevice58"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavfilter-extra"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavfilter-extra7"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavfilter7"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavformat-extra"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavformat-extra58"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavformat58"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libavutil56"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libpostproc55"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libswresample3"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:4.4.2-0ubuntu0.22.04.1+esm11",
"binary_name": "libswscale5"
}
]
}{
"binaries": [
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "ffmpeg"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavcodec-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavcodec-extra"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavcodec-extra60"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavcodec60"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavdevice-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavdevice60"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavfilter-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavfilter-extra"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavfilter-extra9"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavfilter9"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavformat-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavformat-extra"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavformat-extra60"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavformat60"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavutil-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libavutil58"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libpostproc-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libpostproc57"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libswresample-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libswresample4"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libswscale-dev"
},
{
"binary_version": "7:6.1.1-3ubuntu5+esm7",
"binary_name": "libswscale7"
}
]
}