CVE-2016-1898 — Sensitive Information Exposure in Ffmpeg

CWE-200 — Sensitive Information Exposure6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
27.8%
top 3.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
FfmpegDebian FfmpegCanonical Ubuntu Linux+1 more
Timeline
PublishedJan 15
Latest updateJan 24

Description

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.8.5-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.8.5-1+3
▶NVDffmpeg/ffmpeg81 versions+80
▶NVDopensuse/leap42.1

Also affects: Ubuntu Linux 12.04

🔴Vulnerability Details

2
GHSA
GHSA-2mw9-cpc8-cf9f: FFmpeg 2↗2022-05-14
▶
OSV
CVE-2016-1898: FFmpeg 2↗2016-01-15
▶

📋Vendor Advisories

2
Ubuntu
Libav vulnerabilities↗2016-04-04
▶
Debian
CVE-2016-1898: ffmpeg - FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbi...↗2016
▶

📄Research Papers

1
arXiv
PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability Repair↗2026-01-24
▶