CVE-2024-31585
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in...
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
CVE-2024-31585- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-193
- Updated
- 2026-11-02
EUVDEUVD-2024-29460
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
EUVD-2024-29460- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vh9p-h4p4-q9vv
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in...
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
GHSA-vh9p-h4p4-q9vv- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-193
- Updated
- 2026-11-02
NVD
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
CVE-2024-31585- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-193
- Updated
- 2026-11-02
OSV
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
CVE-2024-31585- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2024-31585
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
DEBIAN-CVE-2024-31585- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVJLSEC-2025-127
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in...
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Record
JLSEC-2025-127- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2155
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2024-31585)
- Record
OESA-2024-2155- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2202
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2024-31585)
- Record
OESA-2024-2202- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2204
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2024-31585)
- Record
OESA-2024-2204- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2205
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.(CVE-2024-31585)
- Record
OESA-2024-2205- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0248 No score
Updated ffmpeg packages fix security vulnerabilities
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the set_encoder_id function in /fftools/ffmpeg_enc.c component. (CVE-2023-50010) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane. (CVE-2023-51793) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69. (CVE-2023-51794) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame. (CVE-2023-51795) Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate. (CVE-2023-51798) FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVE-2024-31585)
- Record
MGASA-2024-0248- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13888-1 No score
ffmpeg-5-5.1.4-5.1 on GA media
These are all security issues fixed in the ffmpeg-5-5.1.4-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13888-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:5.1.5-0+deb12u1, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u1 |
7:5.1.5-0+deb12u1 |
ffmpegDebian:13 |
before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegDebian:14 |
before 7:7.0.1-3 | 7:7.0.1-3 |
ffmpegDebian:12 From an advisory covering 10 CVEs |
before 7:5.1.5-0+deb12u1, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u1 |
7:5.1.5-0+deb12u1 |
FFMPEG_jllJulia |
6.1.1+0 up to 7.1.0+0 | 7.1.0+0 |
ffmpegMageia:9 From an advisory covering 6 CVEs |
before 5.1.5-1.mga9 | 5.1.5-1.mga9 |
ffmpegMageia:9 From an advisory covering 6 CVEs |
before 5.1.5-1.mga9.tainted | 5.1.5-1.mga9.tainted |
ffmpegopenEuler:22.03-LTS-SP3 |
before 4.2.4-17.oe2203sp3 | 4.2.4-17.oe2203sp3 |
ffmpegopenEuler:22.03-LTS-SP1 |
before 4.2.4-18.oe2203sp1 | 4.2.4-18.oe2203sp1 |
ffmpegopenEuler:22.03-LTS-SP4 |
before 4.2.4-18.oe2203sp4 | 4.2.4-18.oe2203sp4 |
ffmpegopenEuler:20.03-LTS-SP4 |
before 4.2.4-18.oe2003sp4 | 4.2.4-18.oe2003sp4 |
ffmpeg-5openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 5.1.4-5.1 | 5.1.4-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31585 is a medium vulnerability (CVSS 5.3) in Ffmpeg, published April 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in ffmpeg 7:5.1.5-0+deb12u1.
References
github.com/ffmpeg/ffmpeg/commit/ab0fdaedd1e7224f7e84ea22fcbfaa4ca75a6c06
gist.github.com/1047524396/dc2c64ffe0c3934a6176bcd2c5cf5656
lists.fedoraproject.org/archives/list/[email protected]/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY
Show 22 moreShow less
git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/bf2d7b20ea1c7d15dcbaedd479f40295e5c83430..3061bf668feffc7c1f0b244205167b3b86da8015:/libavfilter/avf_showspectrum.c
nvd.nist.gov/vuln/detail/CVE-2024-31585
security-tracker.debian.org/tracker/CVE-2024-31585
advisories.mageia.org/MGASA-2024-0248.html
bugs.mageia.org/show_bug.cgi?id=33338
lists.debian.org/debian-security-announce/2024/msg00122.html
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2155
suse.com/security/cve/CVE-2023-49528