CVE-2017-10699

What it actually does

Out-of-bounds heap memory write in avcodec 2.2.x triggered by memcpy() with incorrect size parameter, enabling denial of service via application crash or potential arbitrary code execution.

Why it matters to the business

Older media processing components in affected packages can be crashed or potentially compromised when handling untrusted input, though the issue is long-standing with low observed exploitation; organizations using prometheus packages must update to avoid residual risk in media-handling paths.

How an attack unfolds

An attacker crafts a malicious media stream or file that reaches avcodec 2.2.x, causing the library to compute an incorrect size for memcpy and write beyond heap bounds; this can crash the process or, under favorable memory conditions, allow control-flow hijacking to execute attacker-supplied code.

How to fix it

Upgrade prometheus (Chainguard) to 2.47.2-r3 or later and prometheus (Wolfi) to 2.47.2-r3 or later; rebuild any containers or images that embed the vulnerable avcodec dependency and verify no older 2.2.x versions remain in runtime environments.

How to confirm the fix worked

Confirm package versions match the fixed releases, scan container images for avcodec 2.2.x presence, and test media decoding paths with known-good and boundary-case inputs to ensure crashes no longer occur.

Typical attack path

1. Deliver a specially crafted media file or stream to an application linked against vulnerable avcodec 2.2.x
2. Trigger the faulty memcpy path during decoding
3. Achieve heap corruption leading to crash or code execution

How to detect it

Review application and system logs for unexpected crashes or segmentation faults during media decoding; examine process memory dumps or core files for signs of heap corruption originating from avcodec.

What your security team should do

• Apply the listed package upgrades immediately across all prometheus deployments
• Audit build pipelines and base images for any remaining avcodec 2.2.x references
• Monitor EPSS and KEV updates for any future change in exploit activity