CVE-2024-32228

What it actually does

A buffer overflow in FFmpeg 7.0's HEVC decoder triggers a segmentation fault at libavcodec/hevcdec.c:2947 in hevc_frame_end, enabling memory corruption or denial of service during media decoding.

Why it matters to the business

Media processing applications may experience crashes or limited exploitation when handling untrusted video files, resulting in service outages and potential data integrity issues for organizations relying on FFmpeg.

How an attack unfolds

An attacker supplies a specially crafted HEVC video file to an application using FFmpeg; when the decoder processes the frame, the overflow condition at hevc_frame_end is reached, leading to a crash or possible code execution.

How to fix it

Upgrade FFmpeg to the latest patched release that resolves the buffer overflow in the HEVC decoder; rebuild dependent applications against the fixed library.

How to confirm the fix worked

Confirm the deployed FFmpeg binary reports a version newer than 7.0, then attempt decoding of test HEVC files that previously triggered the fault to verify absence of the segmentation violation.

Typical attack path

1. Craft and deliver a malicious HEVC-encoded media file to the target
2. Trigger local or remote decoding through FFmpeg's hevcdec module
3. Trigger the buffer overflow at hevc_frame_end to achieve crash or limited control

How to detect it

Review application and system logs for segmentation faults referencing hevcdec.c or hevc_frame_end during video processing; correlate with inbound untrusted media files.

What your security team should do

• Prioritize immediate upgrade of FFmpeg across all media-handling systems
• Temporarily disable processing of untrusted HEVC content until patched
• Add runtime monitoring for decoder crashes in production pipelines