CVE-2020-35965

    Dashboard / Vulnerabilities / CVE-2020-35965

    CVE-2020-35965

    Published: 4 Jan 2021Last Modified: 17 Aug 2026

    Summary:

    Details: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.

    References: https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html, https://security.gentoo.org/glsa/202105-24, https://www.debian.org/security/2021/dsa-4990, https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532, https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b, https://github.com/FFmpeg/FFmpeg/commit/b0a8b40294ea212c1938348ff112ef1b9bf16bb3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6b6b9e593dd4d3aaf75f48d40a13ef03bdef9fdb
    Fixed -c5079bf3bccd24bf8ed45ff47ff4071fd09e9fd8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-35965 | CVE-DB