# Multiple vulnerabilities CVE-2024-22860, 22861, 22862 - FFMPEG : Resolution

**URL:** <https://rossvideo.community/t/multiple-vulnerabilities-cve-2024-22860-22861-22862-ffmpeg-resolution/12997>\
**Category:** Product Security\
**Created:** [February 27, 2024, 10:25pm UTC](https://rossvideo.community/t/multiple-vulnerabilities-cve-2024-22860-22861-22862-ffmpeg-resolution/12997 "2024-02-27T22:25:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://rossvideo.community/uploads/default/original/1X/507e4ebb7c5bc59238f6b32d29e5d386a7aa7913.png) [@system](https://rossvideo.community/u/system)\
**Post date:** [February 27, 2024, 10:25pm UTC](https://rossvideo.community/t/multiple-vulnerabilities-cve-2024-22860-22861-22862-ffmpeg-resolution/12997/1 "2024-02-27T22:25:29Z")

</div>

**Vulnerability Advisories**

FFmpeg, a widely used open-source project for handling multimedia files, has recently been identified for its vulnerabilities. Discovered through Google’s OSS-Fuzz service, three security vulnerabilities have been identified in its systems, two of which are of critical (CVE-2024-22860 and CVE-2024-22862) severity.  
The most severe of these,  
CVE-2024-22860  
and  
CVE-2024-22862  
, both with a CVSS score of 9.8, expose FFmpeg to remote code execution (RCE) attacks due to integer overflow vulnerabilities. These vulnerabilities, present in the JPEG XL Animation decoder and the JPEG XL Parser, respectively, could allow attackers to execute arbitrary code on affected systems.  
Another notable vulnerability,  
CVE-2024-22861,  
rated with a CVSS score of 7.5, could lead to a  
denial of service (DoS) through the avcodec/osq module.

[CVE-2024-22860,22862,22861 FFMPEG - Product Security Advisory.pdf](https://rossvideo.community/uploads/short-url/ipAERZ5QpGNacVc09Voc6o54AMe.pdf) (198 KB)