CVE-2024-36615: Race Condition

Published Nov 29, 2024

Updated

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Affected Software

2 affected components

FFmpeg FFmpeg

FFmpeg FFmpeg=7.0

Remediation

Patch Available

https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61

Event History

Nov 29, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-36615?

CVE-2024-36615 is classified as a moderate severity vulnerability due to the potential for a data race in the VP9 decoder.

How do I fix CVE-2024-36615?

To fix CVE-2024-36615, update to the latest version of FFmpeg that addresses this race condition in the VP9 decoder.

What impact does CVE-2024-36615 have on FFmpeg?

CVE-2024-36615 can lead to unpredictable behavior or data corruption when video encoding parameters are exported in FFmpeg.

Is my system affected by CVE-2024-36615?

If you are using FFmpeg version n7.0, your system may be affected by CVE-2024-36615.

What components of FFmpeg are involved in CVE-2024-36615?

CVE-2024-36615 specifically affects the VP9 decoder component in FFmpeg.