Cyber Resilience

CVE-2023-6601

Ffmpeg 2.0 – 6.0

Public PoC
Published
06 January 2025
Modified
03 November 2025
CVSS Score v3.1 4.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0040 32th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2023-6601 is a medium-severity Resource Injection (CWE-99) vulnerability in Ffmpeg Ffmpeg. Its CVSS base score is 4.7 (Medium).

Operationally, ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-6604Same product: Ffmpeg Ffmpeg
CVE-2023-6605Same product: Ffmpeg Ffmpeg
CVE-2023-6602Same product: Ffmpeg Ffmpeg
CVE-2024-32230Same product: Ffmpeg Ffmpeg
CVE-2026-30998Same product: Ffmpeg Ffmpeg
CVE-2024-32228Same product: Ffmpeg Ffmpeg
CVE-2024-36616Same product: Ffmpeg Ffmpeg
CVE-2024-36618Same product: Ffmpeg Ffmpeg
CVE-2024-7055Same product: Ffmpeg Ffmpeg
CVE-2026-64831Same product: Ffmpeg Ffmpeg

Affected Assets

ffmpeg
ffmpeg
2.0 — 6.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.3.1
  • V1.3.8
  • V1.3.9
  • V1.3.11

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

addresses: CWE-94

Validates inputs used in dynamic code generation to block injected directives.

addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and sanitization that prevent resource-identifier injection flaws.

PR.AA-05 partial match
prevents

Least-privilege access policy and enforcement limits damage from injected resource identifiers even when input validation is absent.

PR.IR-01 partial match
prevents

Network segmentation and unauthorized-access controls reduce the blast radius of successful resource injection.

PR.DS-10 none match
prevents

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect resource-injection flaws but does not itself implement preventive controls.

prevents

Secure SDLC mandates input validation and resource-identifier sanitization that directly prevents resource injection.

prevents

Application security requirements explicitly call for controls on external identifiers used to access resources.

prevents

Secure architecture principles reduce attack surface for resource injection but do not prescribe identifier validation.

prevents

Secure coding standards require strict validation and whitelisting of all resource identifiers before use.

mitigates

Information-access-restriction policies limit which resources can be referenced, indirectly reducing injection impact.

References