A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | 86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41 |
| n/a | n/a | < 6f7cfee1a316891890c505563aa54f3476db52fd |