CVE-2023-39018

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-390209.8stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Piped CVE-2023-390219.8wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Set CVE-2023-390229.8oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createState CVE-2023-390239.8university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.Defa CVE-2023-390267.5Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive i CVE-2023-390396.5An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39047.5An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all CVE-2023-390406.5An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390416.5An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390427.5An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390436.5An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390446.5An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.