ffmpeg-6
Chainguard
5.3
CVSS V3
Status
Impact
The pan filter floating point exception vulnerability is NOT fixed in FFmpeg 6.1.2. The fix (commit b5b6391d64) from January 2025 is not present. The vulnerable code at libavfilter/af_pan.c:176 uses sscanf return value incorrectly - when sscanf returns EOF (-1), it's treated as true, causing arg += len with uninitialized len value. Upstream fix properly checks sscanf return value and returns error on failure. This fix needs to be backported to FFmpeg 6.1.2.
Status