CVE-2023-39018

Name: CVE-2023-39018
Creator: NVD / NIST
Published: 2023-07-28T15:15:13.227+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 0.78%

Last modified Jun 17, 2026

CVE-2023-39018 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. EPSS estimates a 0.78% chance of exploitation in the next 30 days.

Description

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.78%

51.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Bramp	Ffmpeg-Cli-Wrapper	<= 0.7.0

References

https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java
https://github.com/bramp/ffmpeg-cli-wrapper/issues/291Exploit, Issue Tracking, Patch
https://github.com/bramp/ffmpeg-cli-wrapper/blob/master/src/main/java/net/bramp/ffmpeg/FFmpeg.java
https://github.com/bramp/ffmpeg-cli-wrapper/issues/291Exploit, Issue Tracking, Patch

Timeline

Published: Jul 28, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-39018?

How severe is CVE-2023-39018?

CVE-2023-39018 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.78% probability of exploitation in the next 30 days.

How do I fix CVE-2023-39018?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-39018?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST