Integer Overflow Vulnerability in FFmpeg 6.1.1 from FFmpeg

CVE-2024-35366

What is CVE-2024-35366?

The Integer Overflow vulnerability in FFmpeg version 6.1.1 occurs in the parse_options function located in sbgdec.c within the libavformat module. This flaw arises when the software fails to properly validate options during parsing, allowing the acceptance of negative duration values without adequate bounds checking. Consequently, malicious actors can exploit this oversight to manipulate program behavior, potentially leading to unexpected results or security breaches.

References