CVE-2019-9718 — ffmpeg: denial of service in subtitle decoder allows attackers to hog CPU via crafted video file

Back Back to CVE browser

MEDIUM

ffmpeg: denial of service in subtitle decoder allows attackers to hog CPU via crafted video file

Published Mar 12, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.57%

Description

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	qffmpeg	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of qffmpeg as shipped with Red Hat Enterprise Linux 5.

Metrics

1.57% 0.01565

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01565

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.57% (0.01565)	74.38th	v5 (v2026.06.15)
Jun 15, 2026	1.57% (0.01565)	71.98th	v5 (v2026.06.15)
Mar 17, 2025	1.90% (0.01903)	82.04th	v4 (v2025.03.14)
Dec 12, 2024	0.32% (0.00318)	71.33th	v3 (v2023.03.01)
Mar 5, 2024	0.45% (0.00448)	74.42th	v3 (v2023.03.01)
Feb 8, 2024	0.51% (0.00509)	75.87th	v3 (v2023.03.01)
Mar 7, 2023	0.51% (0.00509)	72.91th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	5.19% (0.05189)	75.21th	v2 (v2022.01.01)
Feb 3, 2022	7.62% (0.07623)	84.03th	v1
Jan 6, 2022	7.62% (0.07623)	83.88th	v1
Jan 5, 2022	1.81% (0.01806)	75.23th	v5 (v2026.06.15)
Apr 14, 2021	1.81% (0.01806)	0.00th	v1

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-400

Uncontrolled Resource Consumption

References (10)

http://www.securityfocus.com/bid/107382
vdb-entryx_refsource_BIDBroken Link
https://access.redhat.com/security/cve/CVE-2019-9718
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1708097
Issue Tracking
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
x_refsource_MISCPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-9718
https://seclists.org/bugtraq/2019/May/60
mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://usn.ubuntu.com/3967-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-9718
https://www.debian.org/security/2019/dsa-4449
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/107382		vdb-entryx_refsource_BIDBroken Link
https://access.redhat.com/security/cve/CVE-2019-9718		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1708097		Issue Tracking
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982		x_refsource_MISCPatchThird Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/23ccf3cabb4baf6e8af4b1af3fcc59c904736f21		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-9718
https://seclists.org/bugtraq/2019/May/60		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://usn.ubuntu.com/3967-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-9718
https://www.debian.org/security/2019/dsa-4449		vendor-advisoryx_refsource_DEBIANThird Party Advisory