CVE-2014-1245

critical

Published 2014-02-27 · Modified 2026-04-29

CVSS v3

—

CVSS v2

9.3

VIR risk

9.3

Description

Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://support.apple.com/kb/HT6151

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://support.apple.com/kb/HT6150

Application impact

Vendor	Product	Versions
apple	quicktime	`{"endIncluding":"7.7.4"}`
apple	quicktime	`7.0.0`
apple	quicktime	`7.0.1`
apple	quicktime	`7.0.2`
apple	quicktime	`7.0.3`
apple	quicktime	`7.0.4`
apple	quicktime	`7.1.0`
apple	quicktime	`7.1.1`
apple	quicktime	`7.1.2`
apple	quicktime	`7.1.3`
apple	quicktime	`7.1.4`
apple	quicktime	`7.1.5`
apple	quicktime	`7.1.6`
apple	quicktime	`7.2.0`
apple	quicktime	`7.2.1`
apple	quicktime	`7.3.0`
apple	quicktime	`7.3.1`
apple	quicktime	`7.3.1.70`
apple	quicktime	`7.4.0`
apple	quicktime	`7.4.1`
apple	quicktime	`7.4.5`
apple	quicktime	`7.5.0`
apple	quicktime	`7.5.5`
apple	quicktime	`7.6.0`
apple	quicktime	`7.6.1`
apple	quicktime	`7.6.2`
apple	quicktime	`7.6.5`
apple	quicktime	`7.6.6`
apple	quicktime	`7.6.7`
apple	quicktime	`7.6.8`
apple	quicktime	`7.6.9`
apple	quicktime	`7.7.0`
apple	quicktime	`7.7.1`
apple	quicktime	`7.7.2`
apple	quicktime	`7.7.3`
apple	quicktime	`7.60.92.0`
apple	quicktime	`7.62.14.0`
apple	quicktime	`7.64.17.73`
apple	quicktime	`7.65.17.80`
apple	quicktime	`7.66.71.0`
apple	quicktime	`7.67.75.0`
apple	quicktime	`7.68.75.0`
apple	quicktime	`7.69.80.9`
apple	quicktime	`7.70.80.34`
apple	quicktime	`7.71.80.42`

References

CWEs

CWE-189

Verify integrity in audit chain (admin only). AS-IS.