CVE-2016-2326

Name: CVE-2016-2326
Creator: NVD / NIST
Published: 2016-02-12T05:59:00.117+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.68%

Last modified Jun 17, 2026

CVE-2016-2326 is a vulnerability of currently unknown severity. Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file.. EPSS estimates a 2.68% chance of exploitation in the next 30 days.

Description

Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file.

Metrics

EPSS Probability

2.68%

83.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-190

Affected Software

Vendor	Product	Versions
Debian	Debian Linux	7.0
Debian	Debian Linux	8.0
Canonical	Ubuntu Linux	12.04
Ffmpeg	Ffmpeg	<= 2.8.4

References

http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7c0b84d89911b2035161f5ef51aafbfcc84aa9e2
http://www.debian.org/security/2016/dsa-3506Third Party Advisory
http://www.securityfocus.com/bid/84165Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035010Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2944-1Third Party Advisory
https://security.gentoo.org/glsa/201606-09Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201705-08
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7c0b84d89911b2035161f5ef51aafbfcc84aa9e2
http://www.debian.org/security/2016/dsa-3506Third Party Advisory
http://www.securityfocus.com/bid/84165Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035010Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2944-1Third Party Advisory
https://security.gentoo.org/glsa/201606-09Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201705-08

Timeline

Published: Feb 12, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-2326?

How severe is CVE-2016-2326?

Severity scoring for CVE-2016-2326 is pending analysis. The EPSS model estimates a 2.68% probability of exploitation in the next 30 days.

How do I fix CVE-2016-2326?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-2326?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST