CVE-2021-38291

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2021/11/msg00012.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202312-14
https://trac.ffmpeg.org/ticket/9312Exploit, Patch, Vendor Advisory
https://www.debian.org/security/2021/dsa-4990Third Party Advisory
https://www.debian.org/security/2021/dsa-4998Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00012.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202312-14
https://trac.ffmpeg.org/ticket/9312Exploit, Patch, Vendor Advisory
https://www.debian.org/security/2021/dsa-4990Third Party Advisory
https://www.debian.org/security/2021/dsa-4998Third Party Advisory

Timeline

Published: Aug 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-382949.8A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior CVE-2021-382957.3In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If CVE-2021-382967.5Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.CVE-2021-382979.8Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH CVE-2021-382989.8Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.CVE-2021-382999.8Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerab CVE-2021-38305.4btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-383007.8arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs CVE-2021-383029.8The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-383039.8A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.CVE-2021-383047.8Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially CVE-2021-383057.823andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part