CVE-2024-36617 - Vulnerability Details

Vendors	Products
Ffmpeg	Ffmpeg

Link	Providers
https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274
https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7

Type	Values Removed	Values Added
First Time appeared		Ffmpeg Ffmpeg ffmpeg
CPEs		cpe:2.3:a:ffmpeg:ffmpeg::::::::
Vendors & Products		Ffmpeg Ffmpeg ffmpeg

Type	Values Removed	Values Added
Weaknesses		CWE-190
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.
References		https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274 https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7

Show plain JSON

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-36617", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-12-02T17:57:09.775Z", "dateReserved": "2024-05-30T00:00:00", "datePublished": "2024-11-29T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-11-29T18:10:11.639700"}, "descriptions": [{"lang": "en", "value": "FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274"}, {"url": "https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-02T17:57:06.232843Z", "id": "CVE-2024-36617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:57:09.775Z"}}]}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2024-36617 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

dateUpdated : 2024-12-02T17:57:09.775Z (string)

dateReserved : 2024-05-30T00:00:00 (string)

datePublished : 2024-11-29T00:00:00 (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-11-29T18:10:11.639700 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7 (string)

}

1 : { »

url : https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274 (string)

}

2 : { »

url : https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : n/a (string)

}

]

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-190 (string)

lang : en (string)

description : CWE-190 Integer Overflow or Wraparound (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.2 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-12-02T17:57:06.232843Z (string)

id : CVE-2024-36617 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-02T17:57:09.775Z (string)

}

]

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-02T17:57:06.232843Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:55:46.394Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274"}, {"url": "https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df"}], "descriptions": [{"lang": "en", "value": "FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-11-29T18:10:11.639700"}}}, "cveMetadata": {"cveId": "CVE-2024-36617", "state": "PUBLISHED", "dateUpdated": "2024-12-02T17:57:09.775Z", "dateReserved": "2024-05-30T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-11-29T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.2 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-36617 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-12-02T17:57:06.232843Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-190 (string)

description : CWE-190 Integer Overflow or Wraparound (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-02T17:55:46.394Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7 (string)

}

1 : { »

url : https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274 (string)

}

2 : { »

url : https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : n/a (string)

}

]

}

]

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-11-29T18:10:11.639700 (string)

}

cveMetadata : { »

cveId : CVE-2024-36617 (string)

state : PUBLISHED (string)

dateUpdated : 2024-12-02T17:57:09.775Z (string)

dateReserved : 2024-05-30T00:00:00 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

datePublished : 2024-11-29T00:00:00 (string)

assignerShortName : mitre (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF619235-217F-4155-8B43-3F551A6E9CD6", "versionEndExcluding": "3.4.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "63FBBEE8-C95A-48F4-97DB-C50945F8BA38", "versionEndExcluding": "4.2.9", "versionStartIncluding": "4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "53094C6A-8364-41FF-B723-0964F01EB656", "versionEndExcluding": "4.3.7", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "18CBACDC-227D-466E-BEC3-BDBF61109425", "versionEndExcluding": "4.4.5", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B868E70-5C01-4846-ADCF-F66550DC8A48", "versionEndExcluding": "6.1.2", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}, {"lang": "es", "value": "FFmpeg n6.1.1 tiene una vulnerabilidad de desbordamiento de enteros en el decodificador CAF de FFmpeg."}], "id": "CVE-2024-36617", "lastModified": "2025-06-03T18:06:03.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-11-29T18:15:07.230", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (string)

matchCriteriaId : EF619235-217F-4155-8B43-3F551A6E9CD6 (string)

versionEndExcluding : 3.4.14 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 63FBBEE8-C95A-48F4-97DB-C50945F8BA38 (string)

versionEndExcluding : 4.2.9 (string)

versionStartIncluding : 4.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 53094C6A-8364-41FF-B723-0964F01EB656 (string)

versionEndExcluding : 4.3.7 (string)

versionStartIncluding : 4.3 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 18CBACDC-227D-466E-BEC3-BDBF61109425 (string)

versionEndExcluding : 4.4.5 (string)

versionStartIncluding : 4.4 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4B868E70-5C01-4846-ADCF-F66550DC8A48 (string)

versionEndExcluding : 6.1.2 (string)

versionStartIncluding : 5.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. (string)

}

1 : { »

lang : es (string)

value : FFmpeg n6.1.1 tiene una vulnerabilidad de desbordamiento de enteros en el decodificador CAF de FFmpeg. (string)

}

]

id : CVE-2024-36617 (string)

lastModified : 2025-06-03T18:06:03.973 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 6.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.5 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-11-29T18:15:07.230 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Product (string)

]

url : https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274 (string)

}

2 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7 (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-190 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object