CVE-2024-35366

—

CVSS 3.1

9.1 critical

EPSS

<1%p49

Published

Nov 29, 2024 (Nov 29, 2024)

Modified

Jun 17, 2026

Description

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

Vendors: ffmpeg
Products: ffmpeg
Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.