by Kastro
Paper/Archive/CVE-2024-35366

CVE-2024-35366

ffmpeg ffmpeg — FFmpeg n6.1.1 is Integer Overflow.

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.0.510 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
ffmpeg6.1.1–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6refgithub.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389refgist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf