PT-2024-27097 · FFmpeg+3 · Ffmpeg+3

Published 2024-04-04 · Updated 2025-10-15 · CVE-2024-36619

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FFmpeg version 6.1.1

Description The issue is related to an integer overflow in the WAVARC decoder of the libavcodec library when handling certain block types. This can lead to a denial-of-service (DoS) condition.

Recommendations For FFmpeg version 6.1.1, consider updating to a newer version that addresses the integer overflow issue in the WAVARC decoder of the libavcodec library to prevent potential denial-of-service (DoS) conditions.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2025-12480

CVE-2024-36619

OESA-2025-1017

OPENSUSE-SU-2025:15177-1

USN-7823-1

Affected Products

Ffmpeg

Linuxmint

Ubuntu

Libavcodec

References · 36

• https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4 · Patch
• https://osv.dev/vulnerability/OESA-2025-1017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35368 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7823-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35367 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36619 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12480 · Security Note
• https://ubuntu.com/security/CVE-2024-35365 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-36619 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36619 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36619 · Security Note
• https://ubuntu.com/security/CVE-2024-36613 · Vendor Advisory