The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an asserti…

published 2018-08-23 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-7680

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.3%; EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known

The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.

Patch / fix

distros 5 links 2

debian ubuntu suse opensuse alpine

ffmpeg Debian 14, Debian 13, Debian 12 7:4.0.3-1

debian advisories DEBIAN-CVE-2018-15822

ffmpeg Ubuntu 16.04 LTS 7:2.8.17-0ubuntu0.1
ffmpeg Ubuntu 18.04 LTS 7:3.4.6-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-15822

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

ffmpeg SLE Workstation Extension 15, SLE Module for Package Hub 15, SLE Module for Desktop Applications 15 3.4.2-4.12.4

suse advisories SUSE-SU-2018:3609-1

ffmpeg-4 openSUSE Tumbleweed 4.4-5.2
ffmpeg-4 Package Hub 15 4.0.2-bp150.21.1

opensuse advisories openSUSE-SU-2024:10754-1 openSUSE-SU-2019:1066-1

ffmpeg Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 4.1-r0
ffmpeg Alpine 3.8 3.4.6-r0
ffmpeg Alpine 3.9 4.0.4-r0
ffmpeg4 Alpine 3.22, Alpine 3.21, Alpine 3.20 +4 more 4.1-r0

alpine advisories ALPINE-CVE-2018-15822

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/FFmpeg/FFmpeg@6b67d7f commit
github.com/FFmpeg/FFmpeg@d8ecb33 commit

Exploit prediction

3.27% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

CWE-617 Reachable Assertion

References

github.com /FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10
patch, third-party-advisory
github.com /FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92
patch, third-party-advisory
usn.ubuntu.com /3967-1/
vendor-advisory, third-party-advisory
debian.org /security/2019/dsa-4449
vendor-advisory, third-party-advisory
usn.ubuntu.com /4431-1/
vendor-advisory, third-party-advisory
seclists.org /bugtraq/2019/May/60
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2019/05/msg00043.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2018-15822
NVD CVE-2018-15822

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary