PT-2024-5661 · FFmpeg+1 · Ffmpeg+1

Published 2024-08-08 · Updated 2026-03-17 · CVE-2024-7272

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions up to 5.1.5

Description A critical issue affects the function fill audiodata of the file /libswresample/swresample.c, leading to a heap-based buffer overflow. This can be exploited remotely. The issue was fixed in version 6.0, but a backport for 5.1 was forgotten. The exploit has been disclosed publicly and may be used. Upgrading to version 5.1.6 or 6.0 can address this issue.

Recommendations To resolve the issue, upgrade to FFmpeg version 5.1.6 or 6.0. As a temporary workaround, consider restricting access to the fill audiodata function in the /libswresample/swresample.c file until a patch is applied.

Exploit

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2024-06374

CVE-2024-7272

DSA-5748-1

MGASA-2024-0283

OPENSUSE-SU-2024:14290-1

Affected Products

Astra Linux

Ffmpeg

References · 41

• 🔥 https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc6 · Exploit
• 🔥 https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc5 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-7272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7272 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7272 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0283 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06374 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-7272 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5748-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7272 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14290-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7272 · Security Note