CVE-2024-36613: Integer Overflow

Published Jan 3, 2025

Updated

FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior.

Affected Software

2 affected components

FFmpeg FFmpeg

FFmpeg FFmpeg=6.1.1

Remediation

Patch Available

https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540

Event History

Jan 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-36613?

CVE-2024-36613 is considered a high-severity vulnerability that can lead to a denial-of-service (DoS) condition.

How does CVE-2024-36613 affect FFmpeg?

CVE-2024-36613 affects the DXA demuxer in the libavformat library of FFmpeg, allowing for an integer overflow.

What is the potential impact of CVE-2024-36613?

The vulnerability can result in undefined behavior or a denial-of-service condition when processing certain media files.

How do I fix CVE-2024-36613?

To fix CVE-2024-36613, it is recommended to upgrade to the latest version of FFmpeg that addresses this vulnerability.

Is there a workaround for CVE-2024-36613?

Currently, there are no known workarounds for CVE-2024-36613 other than upgrading the software.