CVE-2024-32230 — Classic Buffer Overflow in Ffmpeg

CWE-120 — Classic Buffer Overflow5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.2%
top 62.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJul 1
Latest updateSep 2

Description

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:5.1.5-0+deb12u1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.3.7-0+deb11u1+3
▶NVDffmpeg/ffmpeg7.0

🔴Vulnerability Details

2
OSV
CVE-2024-32230: FFmpeg 7↗2024-07-01
▶
GHSA
GHSA-q935-8vhv-gg93: FFmpeg 7↗2024-07-01
▶

📋Vendor Advisories

2
Ubuntu
FFmpeg vulnerability↗2024-09-02
▶
Debian
CVE-2024-32230: ffmpeg - FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug ...↗2024
▶