All vulnerabilities

Servers and applications

CVE-2021-3566

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

Severity
Medium 5.5
Published
5 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.3
Sources
NVD

Affected software

SoftwareAffected versions
FFmpegServers and applications · cpe:a:ffmpeg:ffmpeg
  • Every version before 4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-3566
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-3566