PT-2023-8455 · FFmpeg · Ffmpeg

Published 2023-09-04 · Updated 2025-08-11 · CVE-2024-22860

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 6.1

Description The issue is related to an integer overflow vulnerability in the jpegxl anim read packet() function of the JPEG XL Animation decoder in the FFmpeg multimedia library. This vulnerability can be exploited by a remote attacker to execute arbitrary code. The vulnerability is caused by a flaw in the jpegxl anim read packet() component.

Recommendations For FFmpeg versions prior to 6.1, update to version 6.1 or later to resolve the issue. As a temporary workaround, consider disabling the jpegxl anim read packet() function until a patch is available. Restrict access to the JPEG XL Animation decoder to minimize the risk of exploitation.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2024-00860

CVE-2024-22860

Affected Products

Ffmpeg

References · 23

• https://github.com/FFmpeg/FFmpeg/commit/d2e8974699a9e35cc1a926bf74a972300d629cd5 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22860 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22860 · Security Note
• https://bdu.fstec.ru/vul/2024-00860 · Security Note
• https://ubuntu.com/security/CVE-2024-22860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22860 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22860 · Vendor Advisory
• https://t.me/cveNotify/131646 · Telegram Post
• https://t.me/cvenotify/125138 · Telegram Post
• https://opennet.ru/opennews/art.shtml?num=60521 · Note
• https://t.me/pentestingnews/43170 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1751205271051919394 · Twitter Post
• https://t.me/cvenotify/68999 · Telegram Post