PT-2024-10425 · FFmpeg+5 · Ffmpeg+5

Published 2024-03-01 · Updated 2025-11-25 · CVE-2024-31578

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions FFmpeg version n6.1.1

Description The issue is related to a heap use-after-free in the av hwframe ctx init function. This could allow a remote attacker to impact data integrity.

Recommendations For FFmpeg version n6.1.1, consider disabling the av hwframe ctx init function until a patch is available. Restrict access to the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-00957

CVE-2024-31578

DLA-3928-1

MGASA-2025-0067

OPENSUSE-SU-2024:13888-1

OPENSUSE-SU-2024:13894-1

OPENSUSE-SU-2024:13895-1

OPENSUSE-SU-2024_1468-1

OPENSUSE-SU-2024_1470-1

OPENSUSE-SU-2025:14974-1

OPENSUSE-SU-2025_0862-1

SUSE-SU-2024:1468-1

SUSE-SU-2024:1470-1

SUSE-SU-2025:0862-1

USN-6803-1

Affected Products

Astra Linux

Debian

Ffmpeg

Linuxmint

Suse

Ubuntu

References · 115

• https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6803-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31578 · Security Note
• https://osv.dev/vulnerability/DLA-3928-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13895-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49528 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0862-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50010 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31578 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-31578 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY · Vendor Advisory