Integer Overflow Vulnerability in FFmpeg: Denial of Service Risk
Summary
CVE-2024-22861: Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Affects ffmpeg across 3 version ranges.
< 7:6.1-1
< 47ac3e60653da651dfa064b649d0ac297560d8d5
< 87b8c1081959e45ffdcbabb3d53ac9882ef2b5ce
Fixed in 7:6.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides a rich set of libraries and tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created. The software is known for its versatility and performance, making it a popular choice among developers and content creators. However, like any complex software, FFmpeg is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-22861 is an integer overflow issue present in FFmpeg versions prior to n6.1. This flaw resides in the avcodec/osq module, allowing attackers to exploit the overflow condition to cause a denial of service (DoS). When an integer overflow occurs, it can lead to unexpected behavior, including crashes or resource exhaustion, which can render the software unusable. This vulnerability poses a significant risk, especially in environments where FFmpeg is used for processing untrusted media files.
How To Fix
Minimum fixed version
7:6.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can mitigate the risk by avoiding the processing of untrusted or potentially malicious media files until the upgrade is completed. Additionally, monitoring system logs for unusual activity may help identify potential exploitation attempts.
Conclusion
The integer overflow vulnerability in FFmpeg (CVE-2024-22861) poses a significant risk of denial of service. Users are strongly advised to upgrade to the latest version to mitigate this risk. In the meantime, exercising caution with untrusted media files can help reduce exposure to potential attacks.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2024-22861 is an integer overflow vulnerability in FFmpeg that can lead to a denial of service.
FFmpeg versions prior to n6.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check if your application is affected.
If you cannot upgrade, avoid processing untrusted media files and monitor your system for unusual activity.
The CVSS score of CVE-2024-22861 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
