PT-2025-2441 · FFmpeg+4 · Ffmpeg+4

Published 2024-03-26 · Updated 2025-10-15 · CVE-2024-35365

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: FFmpeg version n6.1.1

Description: The issue is a double-free vulnerability in the fftools/ffmpeg mux init.c component of FFmpeg, specifically within the new stream audio function. This vulnerability occurs in the audio processing component of FFmpeg.

Recommendations: For FFmpeg version n6.1.1, consider updating to a newer version that contains a fix for this issue, as the current version has a double-free vulnerability in the new stream audio function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2025-02247

CVE-2024-35365

OESA-2025-1083

OESA-2025-1084

OPENSUSE-SU-2025:14834-1

OPENSUSE-SU-2025:15010-1

OPENSUSE-SU-2025_1450-1

SUSE-SU-2025:1450-1

USN-7823-1

Affected Products

Ffmpeg

Linuxmint

Red Os

Suse

Ubuntu

References · 64

• https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:14834-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1450-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36616 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-35365 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35368 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7823-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35367 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36619 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-35365 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35365 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1084 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-35365 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35366 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15010-1 · Vendor Advisory