CVE-2023-39018 describes a code injection vulnerability in the bramp ffmpeg-cli-wrapper (FFmpeg 0.7.0 and below), specifically within the net.bramp.ffmpeg.FFmpeg.<constructor> component. This critical vulnerability (CVSS 9.8) allows for remote code execution with high impact on confidentiality, integrity, and availability, stemming from passing an unchecked argument. While the vendor disputes its realistic exploitability due to the unlikelihood of untrusted input for the executable path, there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules. Community discussion is minimal, with only one notable mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.7.0CPE matchmatch criteria | cpe:2.3:a:bramp:ffmpeg-cli-wrapper:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.