CVE-2024-36616

What it actually does

Integer overflow in libavformat/westwood_vqa.c when parsing crafted VQA files leads to memory corruption and application crash.

Why it matters to the business

Media processing pipelines and applications that rely on FFmpeg may experience unexpected crashes when ingesting untrusted VQA video files, interrupting encoding, transcoding, or playback operations.

How an attack unfolds

An attacker supplies a specially crafted VQA file that triggers the integer overflow during format parsing in FFmpeg's westwood_vqa decoder, resulting in a denial-of-service condition.

How to fix it

Update FFmpeg to a build that includes commit 86f73277bf014e2ce36dd2594f1e0fb8b3bd6661 or later; rebuild any dependent applications against the patched library.

How to confirm the fix worked

Verify the installed FFmpeg version or git commit includes 86f73277bf014e2ce36dd2594f1e0fb8b3bd6661; test processing of known-good and boundary VQA files for stability.

Typical attack path

1. Attacker generates a malformed VQA file designed to overflow an integer value in the westwood_vqa parser
2. Malicious file is delivered to a target system or service that uses FFmpeg for media handling
3. FFmpeg processes the file, triggering the overflow and subsequent crash

How to detect it

Review application and system logs for FFmpeg crashes or segmentation faults that coincide with VQA file processing; correlate with file ingestion timestamps.

What your security team should do

• Prioritize upgrading all FFmpeg installations to the patched commit within standard change windows
• Restrict processing of untrusted VQA files until patches are applied
• Monitor EPSS and exploit maturity indicators for any future increase in risk