Vulnerability Advisories
FFmpeg, a widely used open-source project for handling multimedia files, has recently been identified for its vulnerabilities. Discovered through Google’s OSS-Fuzz service, three security vulnerabilities have been identified in its systems, two of which are of critical (CVE-2024-22860 and CVE-2024-22862) severity.
The most severe of these,
CVE-2024-22860
and
CVE-2024-22862
, both with a CVSS score of 9.8, expose FFmpeg to remote code execution (RCE) attacks due to integer overflow vulnerabilities. These vulnerabilities, present in the JPEG XL Animation decoder and the JPEG XL Parser, respectively, could allow attackers to execute arbitrary code on affected systems.
Another notable vulnerability,
CVE-2024-22861,
rated with a CVSS score of 7.5, could lead to a
denial of service (DoS) through the avcodec/osq module.
CVE-2024-22860,22862,22861 FFMPEG - Product Security Advisory.pdf (198 KB)