CVE-2020-12284

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

• CWE-787

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734Exploit, Issue Tracking, Vendor Advisory
• https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726Patch, Third Party Advisory
• https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202007-58Third Party Advisory
• https://usn.ubuntu.com/4431-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4722Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734Exploit, Issue Tracking, Vendor Advisory
• https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726Patch, Third Party Advisory
• https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202007-58Third Party Advisory
• https://usn.ubuntu.com/4431-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4722Third Party Advisory

Published

Apr 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12279An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
• CVE-2020-1228<p>A denial of service vulnerability exists in Windows DNS w…7.5
• CVE-2020-12280iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12281iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12282iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca par…8.8
• CVE-2020-12283Sourcegraph before 3.15.1 has a vulnerable authentication wo…6.1
• CVE-2020-12286In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12…4.3
• CVE-2020-12287Incorrect permissions in the Intel(R) Distribution of OpenVI…7.8
• CVE-2020-12288Protection mechanism failure in some Intel(R) Thunderbolt(TM…5.5
• CVE-2020-12289Out-of-bounds write in some Intel(R) Thunderbolt(TM) control…5.5
• CVE-2020-1229A security feature bypass vulnerability exists in Microsoft …4.3
• CVE-2020-12290Improper access control in some Intel(R) Thunderbolt(TM) con…5.5