CVE-2020-35965 – CVE-2020-35965 is an out-of-bounds write vulner... (How to Fix)

Q: What is the severity of CVE-2020-35965?

CVE-2020-35965 has a CVSS score of 7.5 (HIGH). CVE-2020-35965 is an out-of-bounds write vulnerability in FFmpeg's EXR image decoder that could allow attackers to execute arbitrary code or cause denial of service. This affects systems using FFmpeg to process OpenEXR image files. The vulnerability exists due to incorrect calculations for memset zero operations in the decode_frame function.

📋 TL;DR

CVE-2020-35965 is an out-of-bounds write vulnerability in FFmpeg's EXR image decoder that could allow attackers to execute arbitrary code or cause denial of service. This affects systems using FFmpeg to process OpenEXR image files. The vulnerability exists due to incorrect calculations for memset zero operations in the decode_frame function.

💻 Affected Systems

Products:

FFmpeg

Versions: 4.3.1 and earlier versions

Operating Systems: All platforms running FFmpeg

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability triggers when processing specially crafted OpenEXR (.exr) image files

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise

🟠

Likely Case

Application crash or denial of service

🟢

If Mitigated

Limited impact with proper sandboxing and memory protection

🌐 Internet-Facing: MEDIUM - Requires processing of malicious EXR files

🏢 Internal Only: LOW - Requires user interaction or specific processing workflows

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting malicious EXR files; proof-of-concept available in OSS-Fuzz reports

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: FFmpeg 4.3.2 and later

Vendor Advisory: https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b

Restart Required: Yes

Instructions:

1. Update FFmpeg to version 4.3.2 or later. 2. Rebuild applications using FFmpeg libraries. 3. Restart affected services.

🔧 Temporary Workarounds

Disable EXR decoder

all

Disable the vulnerable EXR decoder module in FFmpeg

ffmpeg -disable-decoder=exr

Input validation

all

Implement file type validation before processing EXR files

🧯 If You Can't Patch

Implement strict input validation for EXR files
Run FFmpeg in sandboxed/containerized environments with limited privileges

🔍 How to Verify

Check if Vulnerable:

Check FFmpeg version: ffmpeg -version | grep 'version'

Check Version:

ffmpeg -version | head -1

Verify Fix Applied:

Verify version is 4.3.2 or higher and test with known malicious EXR files

📡 Detection & Monitoring

Log Indicators:

FFmpeg segmentation faults
Memory access violation errors
Abnormal process termination

Network Indicators:

Unexpected EXR file uploads
Large number of EXR processing requests

SIEM Query:

process.name:ffmpeg AND (event.action:segfault OR event.action:memory_violation)

📊 Metadata

CVE ID: CVE-2020-35965

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-787

Published: January 4, 2021

Last Updated: November 21, 2024

🔗 References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532 Exploit,Issue Tracking,Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b Patch,Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/b0a8b40294ea212c1938348ff112ef1b9bf16bb3 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202105-24 Third Party Advisory
https://www.debian.org/security/2021/dsa-4990 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532 Exploit,Issue Tracking,Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b Patch,Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/b0a8b40294ea212c1938348ff112ef1b9bf16bb3 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202105-24 Third Party Advisory
https://www.debian.org/security/2021/dsa-4990 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-35965, you might also want to check these: