{"id":"CVE-2024-36617","aliases":["ALPINE-CVE-2024-36617","DEBIAN-CVE-2024-36617","DSA-5712-1","DSA-5721-1","EUVD-2024-36354","GHSA-44gv-75g5-gcm5","JLSEC-2025-138","OESA-2024-2574","OESA-2024-2575","OESA-2024-2576","OESA-2024-2577","OESA-2024-2578","SUSE-SU-2025:02352-1","SUSE-SU-2025:02381-1","UBUNTU-CVE-2024-36617","USN-7188-1","USN-8329-1","openSUSE-SU-2025:15177-1","openSUSE-SU-2025:15215-1","openSUSE-SU-2026:20710-1"],"status":"published","title":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00242,"percentile":0.15393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2024-06-15T00:00:00Z","modified":"2026-11-03T06:32:07Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"ffmpeg","fixed_in":["7.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ffmpeg","fixed_in":["7.1.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.5-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:7.0.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:7.0.1-3"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFMPEG_jll","fixed_in":["6.1.2+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"FFplay_jll","fixed_in":["7.1.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","fixed_in":["7:2.8.17-0ubuntu0.1+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","fixed_in":["7:3.4.11-0ubuntu0.1+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","fixed_in":["7:4.4.2-0ubuntu0.22.04.1+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","fixed_in":["7:6.1.1-3ubuntu5+esm8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"7.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"7.1.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.5-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.0.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:7.0.1-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.5-0+deb12u1"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3.7-0+deb11u1"}]}],"versions":["7:4.3.2-0+deb11u2","7:4.3.2-1","7:4.3.2-2","7:4.3.3-0+deb11u1","7:4.3.4-0+deb11u1","7:4.3.5-0+deb11u1","7:4.3.6-0+deb11u1"],"bundled":9},{"source":"osv","ecosystem":"Julia","package":"FFMPEG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.2+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"FFplay_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-21.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-21.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-21.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-17.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-21.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-150600.13.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1+esm9"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm7"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm7"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm6"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm8"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.17-0ubuntu0.1+esm9"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm7"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm7"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm6"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:6.1.1-3ubuntu5+esm8"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4.1"}]}],"bundled":4}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7","tags":["Patch","fix","web","report"]},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","tags":["Product","web","report"]},{"url":"https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","tags":["Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44gv-75g5-gcm5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-36617","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36617.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-36617","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2575","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2576","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2577","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2578","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198898","tags":["report"]},{"url":"https://bugzilla.suse.com/1234018","tags":["report"]},{"url":"https://bugzilla.suse.com/1234019","tags":["report"]},{"url":"https://bugzilla.suse.com/1234020","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36618","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502381-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36617","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36617","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7188-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8329-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H2PRVBAR3CBT6GKTR4CK3DX6YQQ2NP5D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36619","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220545","tags":["report"]},{"url":"https://bugzilla.suse.com/1223304","tags":["report"]},{"url":"https://bugzilla.suse.com/1226308","tags":["report"]},{"url":"https://bugzilla.suse.com/1226892","tags":["report"]},{"url":"https://bugzilla.suse.com/1226897","tags":["report"]},{"url":"https://bugzilla.suse.com/1226898","tags":["report"]},{"url":"https://bugzilla.suse.com/1226899","tags":["report"]},{"url":"https://bugzilla.suse.com/1226900","tags":["report"]},{"url":"https://bugzilla.suse.com/1226901","tags":["report"]},{"url":"https://bugzilla.suse.com/1230983","tags":["report"]},{"url":"https://bugzilla.suse.com/1246790","tags":["report"]},{"url":"https://bugzilla.suse.com/1251137","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7700","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2024-12-02T17:57:09.775Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-36354","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2024-12-02T17:57:09Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:43.613884Z"}],"ghsa":[{"id":"GHSA-44gv-75g5-gcm5","title":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T18:34:03Z","modified":"2024-12-02T18:32:57Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:59:00.95756Z"}],"nvd":[{"id":"CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T18:15:07.23Z","modified":"2026-06-17T07:37:02.12Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"ALPINE-CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T18:15:07.23Z","modified":"2026-11-03T06:32:07.540736618Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T00:00:00Z","modified":"2026-11-07T13:18:05.275480578Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T18:15:07.23Z","modified":"2026-11-02T12:02:34.658257217Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"JLSEC-2025-138","title":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2025-10-19T19:08:53.76Z","modified":"2026-07-18T00:00:09.22014643Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-2574","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\r\n\r\nFFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.(CVE-2024-35368)\r\n\r\nAn integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.(CVE-2024-36616)\r\n\r\nFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.(CVE-2024-36617)\r\n\r\nFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.(CVE-2024-36618)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:18:43.503542265Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2575","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\r\n\r\nFFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.(CVE-2024-35368)\r\n\r\nAn integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.(CVE-2024-36616)\r\n\r\nFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.(CVE-2024-36617)\r\n\r\nFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.(CVE-2024-36618)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:18:43.537058077Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2576","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\r\n\r\nFFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.(CVE-2024-35368)\r\n\r\nAn integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.(CVE-2024-36616)\r\n\r\nFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.(CVE-2024-36617)\r\n\r\nFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.(CVE-2024-36618)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:17:43.884159985Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2577","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\r\n\r\nFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.(CVE-2024-36617)\r\n\r\nFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.(CVE-2024-36618)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:17:43.879721607Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2578","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\r\n\r\nFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.(CVE-2024-36617)\r\n\r\nFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.(CVE-2024-36618)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:17:43.86858106Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.","status":"published","published":"2024-11-29T18:15:00Z","modified":"2026-05-28T14:29:20.584569484Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"DSA-5712-1","title":"ffmpeg - security update","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-03-09T02:09:24.978175Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5721-1","title":"ffmpeg - security update","status":"published","published":"2024-06-26T00:00:00Z","modified":"2026-03-09T02:09:45.343146Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2025:15177-1","title":"ffmpeg-7-7.1.1-4.1 on GA media","description":"These are all security issues fixed in the ffmpeg-7-7.1.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.314045Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15215-1","title":"ffmpeg-4-4.4.6-4.1 on GA media","description":"These are all security issues fixed in the ffmpeg-4-4.4.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.087925Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:20710-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\nChanges in ffmpeg-4:\n\n- CVE-2025-59728: Fixed out-of-bounds NUL-byte write when calculating the content path in handling of MPEG-DASH manifests (bsc#1251137).\n- CVE-2025-7700: Fixed a NULL Pointer Dereference in the ALS Decoder (bsc#1246790)\n- CVE-2024-36618: Fixed a integer overflow in AVI demuxer (bsc#1234020)\n- CVE-2023-6601: Fixed HLS Unsafe File Extension Bypass (bsc#1220545).\n\n- Update to release 4.4.6\n  * lavc/libx265: unbreak build for X265_BUILD \u003e= 210\n  * ARM: vp9mc: Load only 12 pixels in the 4 pixel wide\n    horizontal filter\n  * rtmpproto: Avoid rare crashes in the `fail:` codepath in\n    rtmp_open\n  * avcodec/snow: Fix off by 1 error in run_buffer\n  * avcodec/mpegvideo_enc: Check FLV1 resolution limits\n","status":"published","published":"2026-05-09T08:50:33Z","modified":"2026-05-11T08:15:31.297138Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:02352-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2022-1475: Fixed integer overflow in g729_parse() in llibavcodec/g729_parser.c (bsc#1198898).\n- CVE-2024-36616: Fixed integer overflow in the component libavformat/westwood_vqa.c (bsc#1234018).\n- CVE-2024-36617: Fixed integer overflow vulnerability in the FFmpeg CAF decoder (bsc#1234019).\n- CVE-2024-36618: Fixed vulnerability in the AVI demuxer of the libavformat library (bsc#1234020).\n","status":"published","published":"2025-07-17T12:33:21Z","modified":"2026-03-23T04:47:44.244244Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02381-1","title":"Security update for ffmpeg-4","description":"This update for ffmpeg-4 fixes the following issues:\n\n- CVE-2024-36618: Fixed integer overflow iff ULONG_MAX \u003c INT64_MAX (bsc#1234020).\n\nNew CVE references, fixed in previous release:\n\n- CVE-2024-36617: avformat/cafdec: dont seek beyond 64bit (bsc#1234019).\n- CVE-2024-36616: avformat/westwood_vqa: Fix 2g packets (bsc#1234018).\n","status":"published","published":"2025-07-18T14:58:40Z","modified":"2026-03-23T04:48:34.184457Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7188-1","title":"ffmpeg vulnerability","description":"It was discovered that FFmpeg incorrectly handled certain input, which\ncould lead to an integer overflow. An attacker could possibly use this\nissue to cause a denial of service by crashing the application.\n","status":"published","published":"2025-01-08T00:32:34Z","modified":"2026-06-25T13:32:29.940780842Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-8329-1","title":"ffmpeg vulnerability","description":"It was discovered that the FFmpeg CAF decoder incorrectly handled certain\nfile size calculations. An attacker could possibly use this issue to cause\nFFmpeg to crash, resulting in a denial of service.","status":"published","published":"2026-05-28T07:13:19Z","modified":"2026-05-28T14:29:20.385708856Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}