CVE-2018-13302

In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.

• CWE-129

• http://www.securityfocus.com/bid/104675Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/ed22dc22216f74c75ee7901f82649e1ff725ba50Patch
• https://www.debian.org/security/2018/dsa-4249Third Party Advisory
• http://www.securityfocus.com/bid/104675Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/ed22dc22216f74c75ee7901f82649e1ff725ba50Patch
• https://www.debian.org/security/2018/dsa-4249Third Party Advisory

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13297Information exposure vulnerability in SYNO.SynologyDrive.Fil…5.3
• CVE-2018-13298Channel accessible by non-endpoint vulnerability in privacy …4.2
• CVE-2018-13299Relative path traversal vulnerability in Attachment Uploader…4.3
• CVE-2018-1330When parsing a malformed JSON payload, libprocess in Apache …
• CVE-2018-13300In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParame…
• CVE-2018-13301In FFmpeg 4.0.1, due to a missing check of a profile value b…
• CVE-2018-13303In FFmpeg 4.0.1, a missing check for failure of a call to in…
• CVE-2018-13304In libavcodec in FFmpeg 4.0.1, improper maintenance of the c…
• CVE-2018-13305In FFmpeg 4.0.1, due to a missing check for negative values …
• CVE-2018-13306System command injection in formDlna in TOTOLINK A3002RU ver…
• CVE-2018-13307System command injection in fromNtp in TOTOLINK A3002RU vers…
• CVE-2018-13308Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU v…