FFmpeg Out-of-Bounds Read Vulnerability in RV60 Video Decoder

A vulnerability allowing out-of-bounds read has been identified in the FFmpeg RV60 video decoder, specifically in versions 8.0 and 8.0.1. The issue arises from insufficient validation of the quantization parameter (qp) in the decoder. While the lower bound is checked, the upper bound validation is missing, allowing qp values to exceed the valid range and access memory out of bounds. This flaw could lead to memory disclosure or a crash.

Impact

Exploitation of this vulnerability can cause an out-of-bounds read, potentially leading to memory disclosure or a crash.

Remediation

Users can upgrade to FFmpeg version 8.1, where this vulnerability has been fixed.