CVE-2019-17542
📋 TL;DR
CVE-2019-17542 is a critical heap-based buffer overflow vulnerability in FFmpeg's VQA video decoder. Attackers can exploit this by crafting malicious video files to execute arbitrary code or crash applications. Any system using FFmpeg to process untrusted video content is affected.
💻 Affected Systems
- FFmpeg
- Any software using FFmpeg libraries
📦 What is this software?
Ffmpeg by Ffmpeg
Ffmpeg by Ffmpeg
Ffmpeg by Ffmpeg
Ffmpeg by Ffmpeg
Ffmpeg by Ffmpeg
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Application crashes leading to denial of service, with potential for limited code execution in memory-corrupted processes.
If Mitigated
Contained crashes without code execution if memory protections (ASLR, DEP) are effective, but still causing service disruption.
🎯 Exploit Status
Proof-of-concept exists in the OSS-Fuzz bug report; crafting malicious VQA files is straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FFmpeg 4.2 and later
Vendor Advisory: https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2
Restart Required: Yes
Instructions:
1. Update FFmpeg to version 4.2 or later. 2. For Linux: Use package manager (apt-get update && apt-get upgrade ffmpeg). 3. For Windows: Download latest build from ffmpeg.org. 4. Restart all services using FFmpeg.
🔧 Temporary Workarounds
Disable VQA decoder
linuxRemove or disable VQA video format support in FFmpeg configuration
Recompile FFmpeg with --disable-decoder=vqavideo
Input validation
allBlock or scan VQA video files before processing
🧯 If You Can't Patch
- Implement strict file upload controls to reject VQA video files
- Run FFmpeg in sandboxed/containerized environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: ffmpeg -version | grep 'version'Check Version:
ffmpeg -version | head -1Verify Fix Applied:
Confirm version is 4.2 or higher and test with known malicious VQA sample📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults
- Memory access violation errors
- Unexpected process termination
Network Indicators:
- Unusual outbound connections from media processing servers
- Large VQA file uploads to processing endpoints
SIEM Query:
Process:ffmpeg AND (EventID:1000 OR Signal:SIGSEGV)🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919
- https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2
- https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html
- https://security.gentoo.org/glsa/202003-65
- https://usn.ubuntu.com/4431-1/
- https://www.debian.org/security/2020/dsa-4722
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919
- https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2
- https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html
- https://security.gentoo.org/glsa/202003-65
- https://usn.ubuntu.com/4431-1/
- https://www.debian.org/security/2020/dsa-4722
