Package
ffmpeg-6
Component
ffmpeg-6
Latest update
Fixed version
6.1.3-r0
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
6.1.3-r0Status
Impact
The pan filter floating point exception vulnerability is NOT fixed in FFmpeg 6.1.2. The fix (commit b5b6391d64) from January 2025 is not present. The vulnerable code at libavfilter/af_pan.c:176 uses sscanf return value incorrectly - when sscanf returns EOF (-1), it's treated as true, causing arg += len with uninitialized len value. Upstream fix properly checks sscanf return value and returns error on failure. This fix needs to be backported to FFmpeg 6.1.2.
Status