CVE-2024-32229

What it actually does

Heap buffer overflow in FFmpeg's copy_column function at libavfilter/vf_tiltandshift.c:189 allows out-of-bounds memory writes during tilt-and-shift video filtering operations.

Why it matters to the business

Applications processing untrusted video or image content risk crashes, arbitrary code execution, or data corruption, potentially disrupting media workflows and exposing systems to compromise.

How an attack unfolds

An attacker supplies a specially crafted video file or stream that triggers the tiltandshift filter; when the filter processes the input, the copy_column routine writes beyond allocated heap bounds, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade danswer-ai/danswer to commit 89ff07a96b41be9e05256bd252105be233f4d28a or later; rebuild any dependent FFmpeg integrations with patched libavfilter; avoid processing untrusted media with the affected tiltandshift filter until updated.

How to confirm the fix worked

Confirm danswer-ai/danswer is at or beyond commit 89ff07a96b41be9e05256bd252105be233f4d28a; run regression tests exercising tiltandshift on boundary-case inputs; monitor for absence of heap overflow signals in sanitizer-enabled builds.

Typical attack path

1. Identify target application that invokes FFmpeg with tiltandshift filter on user-supplied media
2. Craft malicious input designed to overflow the column copy buffer
3. Deliver the input via file upload, streaming URL, or command-line argument
4. Trigger filter processing to achieve memory corruption
5. Leverage resulting primitive for code execution or denial of service

How to detect it

Review application logs for crashes or segmentation faults during video filter operations; inspect FFmpeg process memory dumps or sanitizer reports for heap overflow indicators around vf_tiltandshift; correlate with file upload or media ingestion events.

What your security team should do

• Immediately update danswer-ai/danswer to the referenced fixed commit across all deployments
• Inventory all media-processing pipelines that may invoke the tiltandshift filter
• Implement input sanitization or filter whitelisting for untrusted video content
• Enable ASAN or similar memory safety tooling in CI for FFmpeg-dependent builds