Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-35366

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

Published

2024-11-29T20:15:19.863

Last Modified

2025-06-03T16:03:53.080

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses

Type: Secondary
CWE-190

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ffmpeg	ffmpeg	6.1.1	Yes

References

https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf Third Party Advisory ([email protected])
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389 Product ([email protected])
https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6 Patch ([email protected])