CVE-2024-35366

What it actually does

Integer overflow in parse_options of sbgdec.c allows negative duration values to bypass bounds checks, leading to incorrect memory allocations or calculations during SBG file parsing in libavformat.

Why it matters to the business

Media processing pipelines using FFmpeg may experience crashes, corrupted output, or unexpected behavior when handling certain input files, potentially disrupting content workflows and requiring emergency updates.

How an attack unfolds

An attacker crafts a malicious SBG file with specially chosen option values that produce negative durations; when FFmpeg parses the file via the affected function, the overflow occurs without validation, potentially triggering memory corruption or denial of service.

How to fix it

Update ffmpeg to the commit 0bed22d597b78999151e3bde0768b7fe763fc2a6 or later; rebuild affected applications against the patched version and validate all SBG parsing paths.

How to confirm the fix worked

Confirm the installed FFmpeg binary reports a build containing commit 0bed22d597b78999151e3bde0768b7fe763fc2a6; test parsing of sample SBG files with negative duration values to verify no overflow occurs.

Typical attack path

1. Identify target systems processing SBG files with FFmpeg
2. Generate malformed SBG input containing negative duration options
3. Deliver the file through supported input channels such as local files or network streams
4. Trigger parsing in libavformat to induce the integer overflow

How to detect it

Monitor application logs and crash reports for segmentation faults or assertion failures during SBG file parsing; review FFmpeg process invocations involving sbgdec.c for unexpected negative values or malformed option strings.

What your security team should do

• Apply the patch to all FFmpeg deployments within 30 days
• Inventory media processing services that accept untrusted SBG or related inputs
• Add runtime checks or sandboxing around FFmpeg invocations until patched