CVE-2018-15822: High severity FFmpeg FFmpeg vulnerability
Last updated 25 August 2025
Other sources
The flvwritepacket function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.9-0+deb11u2Fixed in 7:5.1.8-0+deb12u1Fixed in 7:7.1.3-0+deb13u1Fixed in 7:8.0.1-3Fixed in 7:8.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.1-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 3.4.6-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.0.4-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.1-r0
Event History
Frequently Asked Questions
What is CVE-2018-15822?
CVE-2018-15822 is a vulnerability in FFmpeg that allows an attacker to cause a denial of service (assertion failure) by exploiting an empty audio packet.
What is the severity of CVE-2018-15822?
CVE-2018-15822 has a severity rating of 7.5 (high).
How does CVE-2018-15822 affect FFmpeg?
CVE-2018-15822 affects FFmpeg versions up to and including 2.8.
How can I fix CVE-2018-15822 in Ubuntu?
To fix CVE-2018-15822 in Ubuntu, update the ffmpeg package to version 7:2.8.17-0ubuntu0.1, 7:3.4.6-0ubuntu0.18.04.1, or 7:4.0.4-0ubuntu1 depending on your Ubuntu version.
How can I fix CVE-2018-15822 in Debian?
To fix CVE-2018-15822 in Debian, update the ffmpeg package to version 7:4.1.9-0+deb10u1, 7:4.1.11-0+deb10u1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, or 7:6.0-9.