VIR Vulnerability Intelligence Relay

CVE-2014-2099

medium
Published 2014-03-02 · Modified 2026-04-29
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-2099

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed0
debian debianbullseyefixed0
debian debianforkyfixed0
debian debiansidfixed0
debian debiantrixiefixed0

Application impact
VendorProductVersionsFixed
ffmpegffmpeg{"endIncluding":"2.1.3"}
ffmpegffmpeg2.0
ffmpegffmpeg2.0.1
ffmpegffmpeg2.0.2
ffmpegffmpeg2.0.3
ffmpegffmpeg2.1
ffmpegffmpeg2.1.1
ffmpegffmpeg2.1.2

References

CWEs

CWE-189

Verify integrity in audit chain (admin only). AS-IS.