cbcvebase.
CVE-2020-21688
published 2021-08-10

CVE-2020-21688: A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.

PriorityP345high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.72%
75.1th percentile
A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.

Affected

11 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianffmpeg< ffmpeg 7:4.4-5 (bookworm)ffmpeg 7:4.4-5 (bookworm)
ffmpegffmpeg
ffmpegffmpeg>= 0 < 7:4.3.3-0+deb11u17:4.3.3-0+deb11u1
ffmpegffmpeg>= 0 < 7:4.4-57:4.4-5
ffmpegffmpeg>= 0 < 7:4.4-57:4.4-5
ffmpegffmpeg>= 0 < 7:4.4-57:4.4-5
ffmpegffmpeg>= 0 < 7:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1
ffmpegffmpeg>= 0 < 7:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1
ffmpegffmpeg>= 0 < 7:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1
ffmpegffmpeg>= 0 < 7:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm4

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.