CVE-2024-12133

What it actually does

The flaw causes libtasn1 to perform inefficient parsing of certificates containing a large number of elements, resulting in excessive CPU time or process termination.

Why it matters to the business

Systems that process untrusted certificates can experience degraded performance or outages, disrupting services that rely on certificate validation such as media processing pipelines.

How an attack unfolds

An attacker crafts a certificate with an unusually high number of ASN.1 elements and supplies it to any ffmpeg component that invokes libtasn1 certificate handling; the library then consumes disproportionate resources, producing a denial of service.

How to fix it

Upgrade ffmpeg packages on Debian 11, 12, 13, and 14 to version 7:3.3.4-1 or later; rebuild any locally compiled ffmpeg against a patched libtasn1; restart affected services after installation.

How to confirm the fix worked

Confirm the installed ffmpeg package version matches or exceeds 7:3.3.4-1 on each Debian release; test certificate parsing with a large-element sample to verify processing time remains bounded.

Typical attack path

1. Identify a service or workflow that accepts or validates certificates via ffmpeg or libtasn1
2. Generate a malicious certificate containing thousands of ASN.1 elements
3. Deliver the certificate to the target over the network or through file input
4. Observe resource exhaustion or crash in the affected process

How to detect it

Review application and system logs for ffmpeg processes that terminate unexpectedly or exhibit prolonged CPU usage while handling certificate files; correlate with inbound certificate data sources.

What your security team should do

• Apply the listed package upgrades on all Debian systems running the affected ffmpeg versions within the next maintenance window
• Review any custom builds or containers that bundle ffmpeg and update them to the fixed version
• Monitor certificate-processing workloads for sudden latency spikes until patches are deployed