CVE-2024-36619

What it actually does

Integer overflow in the WAVARC decoder of libavcodec when processing certain block types in FFmpeg, resulting in a denial-of-service condition.

Why it matters to the business

Disrupts media encoding, decoding, and playback services that rely on FFmpeg, potentially causing outages in video processing pipelines with limited real-world exploitation risk due to stable low EPSS and absence from known exploited vulnerabilities lists.

How an attack unfolds

An attacker crafts a specially malformed WAV file containing block types that trigger the integer overflow in the WAVARC decoder; when FFmpeg processes the file during decoding, the overflow leads to a crash or DoS without further code execution.

How to fix it

Update FFmpeg to the fixed commit 28c7094b25b689185155a6833caf2747b94774a4 or later equivalent release; rebuild any dependent applications against the patched version and validate the update across affected GIT-based deployments.

How to confirm the fix worked

Verify the deployed FFmpeg binary or source matches or exceeds commit 28c7094b25b689185155a6833caf2747b94774a4; test decoding of known-triggering WAV files to confirm absence of crash; monitor version strings in build outputs and package manifests.

Typical attack path

1. Identify FFmpeg-based media processing endpoints or applications accepting user-supplied audio files
2. Craft a malicious WAV file with specific block types designed to trigger integer overflow in the WAVARC decoder
3. Deliver the file via upload, download, or embedded media to the target FFmpeg instance
4. Trigger decoding of the file, causing the overflow and resulting denial-of-service

How to detect it

Monitor application and system logs for FFmpeg crashes or segmentation faults during WAV file decoding; inspect process termination events tied to libavcodec WAVARC handling; review file upload or processing logs for unusual WAV inputs around crash timestamps.

• ffmpeg.*WAVARC
• libavcodec.*integer overflow
• segmentation fault.*wavarc

What your security team should do

• Prioritize patching FFmpeg instances in media pipelines to the fixed commit due to the direct DoS impact on core functionality
• Implement input validation or sandboxing for untrusted media files processed by FFmpeg until updates are applied
• Review and update dependency manifests to enforce the patched version across all downstream consumers