VulnerabilityModified

CVE-2014-3157

HIGH 7.5EPSS 1.76%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 1.76% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: google/chrome
Source: chrome-cve-admin@google.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.