Integer Overflow Vulnerability in FFmpeg Software
CVE-2024-22862

9.8CRITICAL

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
27 January 2024

What is CVE-2024-22862?

An integer overflow vulnerability exists in FFmpeg software versions prior to n6.1, specifically within the JJPEG XL Parser component. This flaw enables remote attackers to exploit the application, potentially leading to arbitrary code execution. The vulnerability can be triggered by specially crafted input, allowing malicious entities to control the affected system. Users of FFmpeg are advised to update to the latest version to mitigate risk.

References

https://github.com/FFmpeg/FFmpeg/commit/ca09d8a0dcd82e312...
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62113

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.