Cloudanix VulnDB

CVE-2024-35369

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Nov 29, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how FFmpeg reads certain audio files can cause programs using it to crash when they try to play or process those files.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient validation of Speex extradata parameters in avcodec/speexdec.c allows integer overflow during parsing, resulting in undefined behavior or process crashes on decode.

Why it matters to the business

Applications using FFmpeg to handle Speex audio may crash when opening specially crafted media files, interrupting media workflows and requiring restarts or patches.

How an attack unfolds

An attacker creates a Speex-encoded media file containing malformed extradata that triggers an integer overflow in the decoder; when a vulnerable FFmpeg instance decodes the file locally, the overflow leads to a crash or undefined behavior.

How to fix it

Upgrade FFmpeg to the fixed commit 0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c or later; rebuild any dependent applications against the patched library and validate Speex decoding paths.

How to confirm the fix worked

Confirm the installed FFmpeg binary or library reports a version containing commit 0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c; test decoding of known-good and edge-case Speex files to ensure no crashes occur.

Typical attack path

  1. Craft Speex media file with invalid extradata parameters designed to cause integer overflow
  2. Deliver the file to a target system running vulnerable FFmpeg (n6.1.1 or equivalent GIT builds)
  3. Induce the target application to decode the file via local file open or UI interaction
  4. Trigger crash or undefined behavior during Speex decoding in avcodec/speexdec.c

How to detect it

Review application or system logs for FFmpeg crashes or segmentation faults occurring during Speex codec initialization; correlate with recent local file access to Speex-containing media.

What your security team should do

  • Prioritize upgrade of FFmpeg installations to the patched commit in all media-processing pipelines
  • Scan build systems and containers for affected GIT revisions of ffmpeg/ffmpeg
  • Add Speex decoding to regression test suites using malformed extradata samples
  • Monitor for downstream package updates that incorporate the fix

The record

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 ffmpeg 0 No fix
Debian:13 ffmpeg 0 7:7.0.1-3
Ubuntu:20.04:LTS ffmpeg 0 No fix
Ubuntu:22.04:LTS ffmpeg 0 No fix
Ubuntu:24.04:LTS ffmpeg 0 No fix
Ubuntu:24.10 ffmpeg 0 No fix
Ubuntu:Pro:14.04:LTS libav 0 No fix
Ubuntu:Pro:16.04:LTS ffmpeg 0 No fix
Ubuntu:Pro:18.04:LTS ffmpeg 0 No fix

Related vulnerabilities