CVE-2023-6602

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6602

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

A

flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2334338 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html
https://bugzilla.redhat.com/show_bug.cgi?id=2334338 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

03 Nov 2025, 20:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html -

20 Jun 2025, 18:46

Type Values Removed Values Added
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
References () https://bugzilla.redhat.com/show_bug.cgi?id=2334338 - () https://bugzilla.redhat.com/show_bug.cgi?id=2334338 - Exploit, Third Party Advisory
CWE NVD-CWE-noinfo
Summary
  • (es) Se encontró una falla en FFmpeg's TTY Demuxer. Esta vulnerabilidad permite la posible exfiltración de datos mediante el análisis incorrecto de archivos de entrada que no cumplen con los requisitos TTY en las listas de reproducción HLS.
First Time Ffmpeg ffmpeg
Ffmpeg

31 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-31 15:15

Updated : 2025-11-03 20:16

NVD link : CVE-2023-6602

Mitre link : CVE-2023-6602

CVE.ORG link : CVE-2023-6602

JSON object : View

Products Affected

ffmpeg

CWE
CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

NVD-CWE-noinfo