CVE-2024-36615

What it actually does

Race condition in the VP9 decoder allows concurrent attachment of side data in the decoder thread while the output thread reads it, resulting in a data race when video encoding parameters are exported.

Why it matters to the business

Applications using FFmpeg for VP9 video processing may experience crashes, corrupted output, or unpredictable behavior during multi-threaded decoding, potentially disrupting media pipelines and requiring urgent updates across dependent systems.

How an attack unfolds

An attacker supplies a specially crafted VP9 video stream to an application that uses the affected FFmpeg decoder; if encoding parameters are exported during processing, the race between threads can be triggered to cause undefined behavior or crashes.

How to fix it

Upgrade FFmpeg to the commit 0ba058579f332b3060d8470a04ddd3fbf305be61 or later; rebuild any dependent applications against the fixed version and test VP9 decoding paths under concurrent workloads.

How to confirm the fix worked

Confirm the installed FFmpeg binary or library reports a version containing commit 0ba058579f332b3060d8470a04ddd3fbf305be61; run multi-threaded VP9 decode tests with parameter export enabled and verify absence of data-race symptoms via thread sanitizers.

Typical attack path

1. Deliver a VP9-encoded video file or stream containing parameters that trigger side-data export.
2. Ensure the target application invokes the VP9 decoder in a multi-threaded configuration.
3. Trigger concurrent access to side data from decoder and output threads.
4. Observe or exploit resulting data race for denial of service or further impact.

How to detect it

Monitor application logs for VP9 decoder crashes or unexpected side-data handling errors during concurrent video processing; review thread-sanitizer reports or core dumps from media pipelines for race-condition indicators.

What your security team should do

• Prioritize patching all FFmpeg installations to the fixed commit within the next maintenance window.
• Inventory downstream applications and libraries that statically or dynamically link FFmpeg and schedule coordinated updates.
• Enable thread sanitizers or equivalent runtime checks in CI pipelines for media-processing code until patches are deployed.