BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportMedium impact1 neutral

FFmpeg VPK Demuxer Vulnerability Allows Divide-by-Zero Crash with Malicious Files

🔄 Updated 2h ago
Aggregated by BrevFeed security · updated 2h ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • Vulnerability found in FFmpeg's VPK demuxer (libavformat/vpk.c).
  • A crafted 21-byte VPK file can cause a divide-by-zero error (SIGFPE).
  • The `nb_channels` value is not validated before a division in `vpk_read_packet`.
  • The bug can crash any application using FFmpeg to open a malicious VPK file.

Vulnerability Details

A divide-by-zero bug has been identified in the Sony PS2 VPK demuxer within FFmpeg (specifically in `libavformat/vpk.c`). The vulnerability occurs in the `vpk_read_packet` function, where the `vpk->last_block_size` is divided by `par->ch_layout.nb_channels` without checking if `nb_channels` is zero. A malformed VPK header can set `nb_channels` to zero, leading to a SIGFPE (integer divide-by-zero exception) and crashing the application.

Trigger Mechanism

The crash is triggered when a fuzzer's custom AVIO path allows the probe/header data and subsequent packet-read data to diverge. While `vpk_read_header` validates `nb_channels > 0`, by the time `vpk_read_packet` executes, `par->ch_layout.nb_channels` can revert to zero from the original fuzz stream. This allows the division operation to proceed with a zero divisor, causing the crash.

Impact and Severity

This vulnerability is rated as medium severity. It allows a crafted 21-byte input file to crash any FFmpeg-based application that attempts to open a malicious .vpk file or stream. The crash input specifically sets `nb_channels = 0` at header bytes 0x0e–0x11, exploiting the unchecked division.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 2h ago security Jscrambler npm Package Supply Chain Attack Deploys Infostealer 1d ago security New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs 7d ago security ClickFix Social Engineering Attack Raises Cybersecurity Concerns 2h ago security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 1d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~20 min · 17 stories · Aug 27

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

GitHub daedalus/fuzzer

Reporting from

Hacker News Front Page — We found a division by zero bug in FFmpeg with a vibecoded fuzzer 💬 Discuss on HN 3h ago →

A divide-by-zero vulnerability was discovered in FFmpeg's VPK demuxer, which can crash any FFmpeg-based application when processing a specially crafted 21-byte VPK file. The issue stems from a lack of validation for `nb_channels` before a division operation, allowing a malformed VPK header to set this value to zero.