PT-2024-26463 · FFmpeg+3 · Ffmpeg+3

Published 2024-11-29 · Updated 2025-06-03 · CVE-2024-35369

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg version n6.1.1

Description A potential security issue exists in FFmpeg due to insufficient validation of certain parameters when parsing Speex codec extradata. This could lead to integer overflow conditions, resulting in undefined behavior or crashes during the decoding process.

Recommendations For FFmpeg version n6.1.1, consider updating to a newer version that addresses the issue, as the current version may lead to integer overflow conditions and undefined behavior during the decoding process. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2025-06055

CVE-2024-35369

OESA-2025-1017

Affected Products

Astra Linux

Debian

Ffmpeg

Red Os

References · 22

• https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c · Patch
• https://bdu.fstec.ru/vul/2025-06055 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35369 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1017 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-35369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36619 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-35369 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-35369 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35369 · Security Note
• https://ubuntu.com/security/CVE-2024-35369 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-35369 · Vendor Advisory
• https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423 · Note
• https://github.com/FFmpeg/FFmpeg/commit/ab39cc36c72bb73318bb911acb66873de850a107 · Note
• https://github.com/FFmpeg/FFmpeg/commit/66b50445cb36cf6adb49c2397362509aedb42c71 · Note
• https://redos.red-soft.ru/support/secure · Note