CVE-2024-36615

MEDIUM EPSS 34.9%
Published Nov 29, 20241y ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Medium
Find Similar
Published Nov 29, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

CVSS Details

Base Score
5.9
Exploitability
2.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
34.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-362

Affected Products 1

VendorProductVersionRange
ffmpegffmpeg7.0any

References 3

  • gist.github.com https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb
    Third Party Advisory
  • github.com https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738
    Product
  • github.com https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61
    Patch

Remediation

  • github.com https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61
    Patch