7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-50008

CVE-2023-50008: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute...

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-50008

CVE-2023-50008:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-50008 is a heap buffer overflow in FFmpeg's vf_colorcorrect filter. Detailed descriptions from FFmpeg ticket #10701 and GHSA-6cjw-2w3q-pv7g indicate the overflow occurs when writing to 'uhistogram' or 'vhistogram'. These buffers are allocated in 'config_input' based on 's->bits', but accessed in 'colorcorrect' or 'colorcorrect_slice_c' using 's->input_bits'. If 'input_bits > bits', an out-of-bounds write occurs. The provided commit 5f87a68cf70dafeab2fb89b42e41a4c29053b89b is linked as the fix, but its diff only shows additions of 'av_freep' calls in the 'uninit' function of 'libavfilter/vf_colorcorrect.c' to fix memory leaks. This commit does not directly address the described buffer overflow's root cause (the size mismatch). Therefore, the identified vulnerable functions are based on the detailed vulnerability descriptions from the ticket and GHSA, as the provided patch does not itself contain evidence of the overflow logic or its direct fix. The confidence is 'medium' for vf_colorcorrect functions because the evidence comes from secondary sources (ticket/GHSA) rather than the patch diff for the overflow itself. Confidence for 'av_malloc' is 'low' as it's involved but not the site of the primary flaw.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.