Servers and applications
CVE-2017-9993
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Severity
- High 7.5
- Published
- 28 Jun 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.8.12, 3.1.9, 3.2.6, 3.3.2
- Exploit chance
- 16% in the next 30 daysHigher than 97% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Information exposure (CWE-200)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
FFmpegServers and applications · cpe:a:ffmpeg:ffmpeg |
|