CVE-2018-13300

In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.

• CWE-125

• http://www.securityfocus.com/bid/104675Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/95556e27e2c1d56d9e18f5db34d6f756f3011148Patch
• https://github.com/FFmpeg/FFmpeg/commit/e6d3fd942f772f54ab6a5ca619cdaadef26b7702
• https://www.debian.org/security/2018/dsa-4249Third Party Advisory
• http://www.securityfocus.com/bid/104675Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/95556e27e2c1d56d9e18f5db34d6f756f3011148Patch
• https://github.com/FFmpeg/FFmpeg/commit/e6d3fd942f772f54ab6a5ca619cdaadef26b7702
• https://www.debian.org/security/2018/dsa-4249Third Party Advisory

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13295Information exposure vulnerability in SYNO.Personal.Applicat…4.3
• CVE-2018-13296Uncontrolled resource consumption vulnerability in TLS confi…7.5
• CVE-2018-13297Information exposure vulnerability in SYNO.SynologyDrive.Fil…5.3
• CVE-2018-13298Channel accessible by non-endpoint vulnerability in privacy …4.2
• CVE-2018-13299Relative path traversal vulnerability in Attachment Uploader…4.3
• CVE-2018-1330When parsing a malformed JSON payload, libprocess in Apache …
• CVE-2018-13301In FFmpeg 4.0.1, due to a missing check of a profile value b…
• CVE-2018-13302In FFmpeg 4.0.1, improper handling of frame types (other tha…
• CVE-2018-13303In FFmpeg 4.0.1, a missing check for failure of a call to in…
• CVE-2018-13304In libavcodec in FFmpeg 4.0.1, improper maintenance of the c…
• CVE-2018-13305In FFmpeg 4.0.1, due to a missing check for negative values …
• CVE-2018-13306System command injection in formDlna in TOTOLINK A3002RU ver…