← Vulnerability feed

Vulnerability record · CVE-2016-2399 · published 30 January 2017

CVE-2016-2399: Libquicktime integer overflow vulnerability

LLibquicktime · Libquicktime

Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.

7.8 CVSS 3.0 High EPSS 7.2% · top 5.9% CWE-190 · Integer overflow
7.8CVSS 3.0 base score, v2 6.8
7.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.debian.org/security/2017/dsa-3800
http://www.nemux.org/2016/02/23/libquicktime-1-2-4/ ExploitTechnical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/95880 Third Party AdvisoryVDB Entry
https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.html ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/39487/
http://www.debian.org/security/2017/dsa-3800
http://www.nemux.org/2016/02/23/libquicktime-1-2-4/ ExploitTechnical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/95880 Third Party AdvisoryVDB Entry
https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.html ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/39487/

Track CVE-2016-2399 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2017-12143Libquicktime improper input validation vulnerabilityIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cause a deni…EPSS 1.0%6.5CVE-2017-12145Libquicktime improper input validation vulnerabilityIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of ser…EPSS 1.1%6.5CVE-2017-9122Libquicktime vulnerabilityThe quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumpt…EPSS 6.5%6.5CVE-2017-9123Libquicktime out-of-bounds read vulnerabilityThe lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read an…EPSS 3.8%6.5CVE-2017-9124Libquicktime null pointer dereference vulnerabilityThe quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and ap…EPSS 3.8%6.5CVE-2017-9125Libquicktime out-of-bounds read vulnerabilityThe lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over…EPSS 4.9%6.5CVE-2017-9126Libquicktime memory buffer overflow vulnerabilityThe quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overfl…EPSS 4.0%6.5CVE-2017-9127Libquicktime memory buffer overflow vulnerabilityThe quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buf…EPSS 5.1%

Source: NIST National Vulnerability Database (record CVE-2016-2399), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.