CVE-2024-36613

FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806	Third Party Advisory
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125	Product
https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*

History

03 Jun 2025, 16:02

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:::::::*
Summary		(es) FFmpeg n6.1.1 tiene una vulnerabilidad en el demuxer DXA de la librería libavformat que permite un desbordamiento de enteros, lo que potencialmente puede resultar en una condición de denegación de servicio (DoS) u otro comportamiento indefinido.
References	~~() https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806 -~~	() https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806 - Third Party Advisory
References	~~() https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125 -~~	() https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125 - Product
References	~~() https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540 -~~	() https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540 - Patch
First Time		Ffmpeg Ffmpeg ffmpeg

03 Jan 2025, 21:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.2
CWE		CWE-190

03 Jan 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-03 18:15

Updated : 2025-06-03 16:02

NVD link : CVE-2024-36613

Mitre link : CVE-2024-36613

CVE.ORG link : CVE-2024-36613

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-36613", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "published": "2025-01-03T18:15:15.343", "references": [{"url": "https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}, {"lang": "es", "value": "FFmpeg n6.1.1 tiene una vulnerabilidad en el demuxer DXA de la librer\u00eda libavformat que permite un desbordamiento de enteros, lo que potencialmente puede resultar en una condici\u00f3n de denegaci\u00f3n de servicio (DoS) u otro comportamiento indefinido."}], "lastModified": "2025-06-03T16:02:11.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53C87DB5-4F23-45F8-A2F1-BD69CEAC54E2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.2 /10