The dnxhd decoder in FFmpeg prior to 3.2.6, and 3.3.x prior to 3.3.3 allows remote malicious users to cause a denial of service (NULL pointer dereference) via a crafted mov file.
Several vulnerabilities have been discovered in FFmpeg, a multimedia
player, server and encoder These issues could lead to Denial-of-Service
and, in some situation, the execution of arbitrary code
CVE-2017-9608
Yihan Lian of Qihoo 360 GearTeam discovered a NULL pointer access when
parsing a crafted MOV file
CVE-2017-9993
Thierry Fou ...
Vulmon