mirror of
https://github.com/mpv-player/mpv.git
synced 2026-10-29 07:06:59 +08:00
68 lines
2.7 KiB
Markdown
68 lines
2.7 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Only the most recent stable release of mpv is supported with security updates.
|
|
Older releases are **not** maintained and will not receive patches.
|
|
|
|
## What Qualifies as a Security Issue
|
|
|
|
mpv is a desktop media player. It is not designed to be exposed to untrusted
|
|
environments. By design, mpv provides features such as loading user scripts,
|
|
running subprocesses, and controlling playback via IPC. These documented
|
|
mechanisms are not considered security vulnerabilities.
|
|
|
|
A security issue is a bug in mpv's own code that allows untrusted input to cause
|
|
harm beyond the expected scope of playback. Examples include:
|
|
|
|
- Exploitable memory corruption (buffer overflows, use-after-free, etc.) caused
|
|
by crafted media files, subtitles, or playlists.
|
|
- Arbitrary code execution or unexpected file system access triggered by
|
|
malicious input.
|
|
- Information disclosure (e.g. unintended local file reads) through crafted
|
|
input.
|
|
|
|
The following are generally **not** considered security issues:
|
|
|
|
- Behavior resulting from documented features and interfaces.
|
|
- Denial of service (crashes, excessive memory or CPU usage) from crafted input.
|
|
These are typically unavoidable when processing complex media formats and are
|
|
treated as regular bugs.
|
|
- Bugs in third-party dependencies (FFmpeg, libass, libplacebo, etc.) that are
|
|
not caused by mpv-specific usage. These should be reported to the respective
|
|
upstream projects.
|
|
|
|
When in doubt, report it. We would rather triage a non-issue than miss a real
|
|
vulnerability.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in mpv, please report it responsibly
|
|
using **GitHub's private vulnerability reporting** feature:
|
|
|
|
1. Go to the [Security](https://github.com/mpv-player/mpv/security) tab of the
|
|
mpv repository.
|
|
2. Click **"Report a vulnerability"**.
|
|
3. Fill in the advisory form with as much detail as possible, including steps to
|
|
reproduce, affected versions, and potential impact.
|
|
|
|
This creates a private advisory visible only to you and our security team,
|
|
allowing us to discuss and address the issue before any public disclosure.
|
|
|
|
For more information on this process, see
|
|
[GitHub's documentation on private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
|
|
|
|
## Direct Contact
|
|
|
|
If you are unable to use GitHub's reporting feature, you can reach out directly
|
|
to the security team:
|
|
|
|
- **@Akemi** - https://github.com/Akemi
|
|
- **@kasper93** - https://github.com/kasper93
|
|
|
|
## Disclosure Policy
|
|
|
|
- Please **do not** open public issues for security vulnerabilities.
|
|
- We aim to acknowledge reports promptly and work toward a fix in a reasonable
|
|
timeframe.
|