CVE-2024-35366 — Integer Overflow or Wraparound in Ffmpeg

CWE-190 — Integer Overflow or WraparoundCWE-120 — Classic Buffer Overflow6 documents5 sources
Severity
9.1CRITICALNVD
OSV8.8
EPSS
0.2%
top 54.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedNov 29
Latest updateOct 15

Description

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:5.1.5-0+deb12u1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:4.3.7-0+deb11u1+3
▶Ubuntuffmpeg/ffmpeg< 7:2.8.17-0ubuntu0.1+esm12+4
▶NVDffmpeg/ffmpeg6.1.1

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
OSV
ffmpeg vulnerabilities↗2025-10-15
▶
OSV
CVE-2024-35366: FFmpeg n6↗2024-11-29
▶
GHSA
GHSA-gq96-59xw-28wj: FFmpeg n6↗2024-11-29
▶

📋Vendor Advisories

2
Ubuntu
FFmpeg vulnerabilities↗2025-10-15
▶
Debian
CVE-2024-35366: ffmpeg - FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options...↗2024
▶