CVE-2024-35369

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35369
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8 Third Party Advisory
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423 Product
https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*
History

03 Jun 2025, 16:06

Type Values Removed Values Added
Summary
  • (es) En la versión n6.1.1 de FFmpeg, específicamente dentro del módulo avcodec/speexdec.c, existe una vulnerabilidad de seguridad potencial debido a una validación insuficiente de ciertos parámetros al analizar los datos adicionales del códec Speex. Esta vulnerabilidad podría generar condiciones de desbordamiento de números enteros, lo que podría generar un comportamiento indefinido o fallos durante el proceso de decodificación.
References () https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8 - () https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8 - Third Party Advisory
References () https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423 - () https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423 - Product
References () https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c - () https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c - Patch
First Time Ffmpeg ffmpeg
Ffmpeg
CPE cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*

29 Nov 2024, 18:15

Type Values Removed Values Added
CWE CWE-190
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

29 Nov 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-29 17:15

Updated : 2025-06-03 16:06

NVD link : CVE-2024-35369

Mitre link : CVE-2024-35369

CVE.ORG link : CVE-2024-35369

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-190

Integer Overflow or Wraparound