Improper Validation Vulnerability in FFmpeg by VideoLAN
CVE-2024-31581

9.8CRITICAL

Key Information:

Vendor

VideoLAN
Status
FFmpeg
Vendor
CVE Published:
17 April 2024

What is CVE-2024-31581?

An improper validation found in FFmpeg's libavcodec can lead to undefined behavior during the processing of data. This vulnerability arises from insufficient checks on array indexes, potentially allowing attackers to exploit this flaw. The issue was identified in the cbs_h266_syntax_template.c file, where certain inputs can bypass validation checks, leading to unpredictable application behavior.

References

https://github.com/ffmpeg/ffmpeg/commit/ce0c178a408d43e71...
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/c...
https://gist.github.com/1047524396/a7e9273e12553775826784...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.