Not rated
CVE-2021-3566 Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it
Description
Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ffmpeg | Versions not published |
References
- github.com github.com
- [debian-lts-announce] 20210815 [SECURITY] [DLA 2742-1] ffmpeg security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of ffmpeg
The 11 CVEs of ffmpeg →
CVE-2026-90816
A vulnerability was found in FFmpeg 8.0.x
5.3
Medium
CVE-2026-90815
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1
5.3
Medium
CVE-2025-1816
A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb
5.3
Medium
CVE-2025-1594
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1
5.3
Medium