CVE-2024-36618
published 2024-11-29CVE-2024-36618: FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a…
PriorityP423medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
EPSS
0.24%
15.7th percentile
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:5.1.8-0+deb12u1 (bookworm) | ffmpeg 7:5.1.8-0+deb12u1 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:4.3.8-0+deb11u2 | 7:4.3.8-0+deb11u2 |
| ffmpeg | ffmpeg | >= 0 < 7:5.1.8-0+deb12u1 | 7:5.1.8-0+deb12u1 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:7.0.1-3 | 7:7.0.1-3 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm12 | 7:2.8.17-0ubuntu0.1+esm12 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm10 | 7:3.4.11-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm10 | 7:4.2.7-0ubuntu0.1+esm10 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4.2-0ubuntu0.22.04.1+esm9 | 7:4.4.2-0ubuntu0.22.04.1+esm9 |
| ffmpeg | ffmpeg | >= 0 < 7:6.1.1-3ubuntu5+esm5 | 7:6.1.1-3ubuntu5+esm5 |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FFmpeg 6.1.1 AVI Demuxer denial of service (Nessus ID 214861 / WID-SEC-2024-3572)
vuldb·2026-06-22·CVSS 6.2
CVE-2024-36618 [MEDIUM] FFmpeg 6.1.1 AVI Demuxer denial of service (Nessus ID 214861 / WID-SEC-2024-3572)
A vulnerability was found in FFmpeg 6.1.1. It has been rated as problematic. The impacted element is an unknown function of the component AVI Demuxer. This manipulation causes denial of service.
This vulnerability is tracked as CVE-2024-36618. The attack is only possible within the local network. No exploit exists.
It is recommended to apply a patch to fix this issue.
OSV
ffmpeg vulnerabilities
osv·2025-10-15·CVSS 8.8
CVE-2024-35365 [HIGH] ffmpeg vulnerabilities
ffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary cod
OSV
CVE-2024-36618: FFmpeg n6
osv·2024-11-29·CVSS 6.2
CVE-2024-36618 [MEDIUM] CVE-2024-36618: FFmpeg n6
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.
GHSA
GHSA-f9m5-926v-fxw4: FFmpeg n6
ghsa_unreviewed·2024-11-29
CVE-2024-36618 [MEDIUM] CWE-190 GHSA-f9m5-926v-fxw4: FFmpeg n6
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2025-10-15·CVSS 8.8
CVE-2024-35368 [HIGH] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2024-35365)
It was discovered that FFmpeg did not correctly handle certain integer
calculations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-35366)
It was discovered that FFmpeg may perform an out-of-bounds read under
certain circumstances. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-35367)
It was discovered that FFmpeg did not correctly handle certain memory
operations. An attacker could possibly use t
Debian
CVE-2024-36618: ffmpeg - FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library ...
vendor_debian·2024·CVSS 6.2
CVE-2024-36618 [MEDIUM] CVE-2024-36618: ffmpeg - FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library ...
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.
Scope: local
bookworm: resolved (fixed in 7:5.1.8-0+deb12u1)
bullseye: resolved (fixed in 7:4.3.8-0+deb11u2)
forky: resolved (fixed in 7:7.0.1-3)
sid: resolved (fixed in 7:7.0.1-3)
trixie: resolved (fixed in 7:7.0.1-3)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-29
Published