Every CVE Search/ Get API key

CVE-2024-32228

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in...

6.6 MediumFix available

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.25%Up 0.2 points since Jul 2, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
CVE-2024-32228
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-120, CWE-121
Updated
2026-11-02
EUVDEUVD-2024-30047 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
EUVD-2024-30047
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4fr2-p4v7-6hwq 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in...

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
GHSA-4fr2-p4v7-6hwq
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-120
Updated
2026-11-02
NVD 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
CVE-2024-32228
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-120, CWE-121
Updated
2026-11-02
OSV 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
CVE-2024-32228
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-07
OSVDEBIAN-CVE-2024-32228 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
DEBIAN-CVE-2024-32228
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2024-1936 6.3

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.(CVE-2024-32228)

Record
OESA-2024-1936
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-32228 6.6

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

Record
UBUNTU-CVE-2024-32228
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:14097-1 No score

ffmpeg-7-7.0-2.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14097-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14221-1 No score

ffmpeg-5-5.1.4-9.1 on GA media

These are all security issues fixed in the ffmpeg-5-5.1.4-9.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14221-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14226-1 No score

ffmpeg-6-6.1.1-6.1 on GA media

These are all security issues fixed in the ffmpeg-6-6.1.1-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14226-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-32228 No score

CVE-2024-32228 in rootio-ffmpeg - Patched by Root

Root has patched CVE-2024-32228 in the rootio-ffmpeg package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2024-32228
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:13
 before 7:7.0.1-3
7:7.0.1-3
ffmpeg
Debian:14
 before 7:7.0.1-3
7:7.0.1-3
ffmpeg
openEuler:24.03-LTS
 before 6.1.1-11.oe2403
6.1.1-11.oe2403
libav
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6
Show 9 moreShow less
6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1
 None known
ffmpeg
Ubuntu:24.04:LTS
 All versions, plus listed versions
7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1
Show 4 moreShow less
7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu5
 None known
ffmpeg-7
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 7.0-2.1
7.0-2.1
ffmpeg-5
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 5.1.4-9.1
5.1.4-9.1
ffmpeg-6
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 6.1.1-6.1
6.1.1-6.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-32228 is a medium vulnerability (CVSS 6.6) in Ffmpeg, published July 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in ffmpeg 7:7.0.1-3.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open