CVE-2016-10191

Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

• CWE-119

• http://www.openwall.com/lists/oss-security/2017/01/31/12Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/02/02/1Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95989
• https://ffmpeg.org/security.htmlRelease Notes, Vendor Advisory
• https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7Patch
• https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html
• http://www.openwall.com/lists/oss-security/2017/01/31/12Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/02/02/1Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95989
• https://ffmpeg.org/security.htmlRelease Notes, Vendor Advisory
• https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7Patch
• https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html

Published

Feb 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10186An issue was discovered on the D-Link DWR-932B router. /var/…7.5
• CVE-2016-10187The E-book viewer in calibre before 2.75 allows remote attac…
• CVE-2016-10188Use-after-free vulnerability in bitlbee-libpurple before 3.5…
• CVE-2016-10189BitlBee before 3.5 allows remote attackers to cause a denial…
• CVE-2016-1019Adobe Flash Player 21.0.0.197 and earlier allows remote atta…9.8
• CVE-2016-10190Heap-based buffer overflow in libavformat/http.c in FFmpeg b…
• CVE-2016-10192Heap-based buffer overflow in ffserver.c in FFmpeg before 2.…
• CVE-2016-10193The espeak-ruby gem before 1.0.3 for Ruby allows remote atta…
• CVE-2016-10194The festivaltts4r gem for Ruby allows remote attackers to ex…
• CVE-2016-10195The name_parse function in evdns.c in libevent before 2.1.6-…9.8
• CVE-2016-10196Stack-based buffer overflow in the evutil_parse_sockaddr_por…7.5
• CVE-2016-10197The search_make_new function in evdns.c in libevent before 2…7.5