CVE-2024-35366

Katalog CVE

CVSS 9.1 · Critical EPSS 0,65%

Kerentanan Integer Overflow or Wraparound pada ffmpeg. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

Rincian

Terbit di NVD

29 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6 patch
• https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf advisory pihak ketiga
• https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389 product