CVE-2024-35366
published 2024-11-29CVE-2024-35366: FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain…
PriorityP348critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.62%
45.8th percentile
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:5.1.5-0+deb12u1 (bookworm) | ffmpeg 7:5.1.5-0+deb12u1 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:4.3.7-0+deb11u1 | 7:4.3.7-0+deb11u1 |
| ffmpeg | ffmpeg | >= 0 < 7:5.1.5-0+deb12u1 | 7:5.1.5-0+deb12u1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm12 | 7:2.8.17-0ubuntu0.1+esm12 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm10 | 7:3.4.11-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm10 | 7:4.2.7-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm9 | 7:4.4.2-0ubuntu0.22.04.1+esm9 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm5 | 7:6.1.1-3ubuntu5+esm5 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FFmpeg 6.1.1 sbgdec.c parse_options duration integer overflow (Nessus ID 270676 / WID-SEC-2024-3572)
vuldb·2026-06-22·CVSS 9.1
CVE-2024-35366 [CRITICAL] FFmpeg 6.1.1 sbgdec.c parse_options duration integer overflow (Nessus ID 270676 / WID-SEC-2024-3572)
A vulnerability was found in FFmpeg 6.1.1. It has been rated as critical. This issue affects the function parse_options of the file sbgdec.c. The manipulation of the argument duration leads to integer overflow.
This vulnerability is listed as CVE-2024-35366. The attack may be initiated remotely. There is no available exploit.
It is suggested to install a patch to address this issue.
OSV
ffmpeg vulnerabilities
osv·2025-10-15·CVSS 8.8
CVE-2024-35365 [HIGH] ffmpeg vulnerabilities
ffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary cod
OSV
CVE-2024-35366: FFmpeg n6
osv·2024-11-29·CVSS 9.1
CVE-2024-35366 [CRITICAL] CVE-2024-35366: FFmpeg n6
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
GHSA
GHSA-gq96-59xw-28wj: FFmpeg n6
ghsa_unreviewed·2024-11-29
CVE-2024-35366 [CRITICAL] CWE-120 GHSA-gq96-59xw-28wj: FFmpeg n6
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2025-10-15·CVSS 8.8
CVE-2024-35368 [HIGH] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use t
Debian
CVE-2024-35366: ffmpeg - FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options...
vendor_debian·2024·CVSS 9.1
CVE-2024-35366 [CRITICAL] CVE-2024-35366: ffmpeg - FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options...
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Scope: local
bookworm: resolved (fixed in 7:5.1.5-0+deb12u1)
bullseye: resolved (fixed in 7:4.3.7-0+deb11u1)
forky: resolved (fixed in 7:7.0.1-3)
sid: resolved (fixed in 7:7.0.1-3)
trixie: resolved (fixed in 7:7.0.1-3)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-29
Published