CVE-2024-35365

What it actually does

Double-free vulnerability in new_stream_audio within fftools/ffmpeg_mux_init.c allowing memory corruption during audio stream initialization.

Why it matters to the business

Media processing pipelines using FFmpeg may crash or become compromised when handling specially crafted inputs, leading to workflow disruptions and potential data exposure in environments reliant on video or audio encoding.

How an attack unfolds

An attacker supplies a malicious media file containing an audio stream that triggers the double-free condition in the muxer initialization path when processed by vulnerable FFmpeg builds.

How to fix it

Upgrade FFmpeg to a build containing commit ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 or later; rebuild any dependent applications against the patched version.

How to confirm the fix worked

Verify the installed FFmpeg commit or source revision matches or exceeds ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5; recompile test binaries and confirm absence of the vulnerable function pattern.

Typical attack path

1. Prepare a crafted input file designed to exercise the audio stream initialization code path
2. Invoke FFmpeg via command line, API, or integration point to process the file
3. Trigger double-free during new_stream_audio execution resulting in memory corruption
4. Leverage corruption for denial of service or potential code execution

How to detect it

Review process crash logs and core dumps from FFmpeg instances for signs of heap corruption; inspect application logs for unexpected terminations during audio stream handling.

What your security team should do

• Apply the fixed commit across all FFmpeg deployments immediately given widespread use in media pipelines
• Scan build systems and containers for outdated GIT checkouts of ffmpeg
• Review and harden any media ingestion workflows that accept untrusted inputs