CVE-2024-7055

What it actually does

Heap-based buffer overflow in pnm_decode_frame within libavcodec/pnmdec.c allows remote attackers to corrupt memory during decoding of crafted PNM image data.

Why it matters to the business

Media processing pipelines and applications relying on FFmpeg may experience crashes, data corruption, or remote code execution, disrupting video workflows and increasing incident response costs.

How an attack unfolds

An attacker crafts a malicious PNM image file that triggers the buffer overflow when processed by the vulnerable pnm_decode_frame function; the file is delivered remotely to any FFmpeg instance performing decoding, potentially leading to arbitrary code execution or denial of service.

How to fix it

Upgrade FFmpeg to version 7.0.2 or later, or apply commit 2ece1f83e41a0f8b88d2d48c5f916a826537cd0c in affected git repositories; rebuild and redeploy dependent applications.

How to confirm the fix worked

Verify installed FFmpeg version is 7.0.2 or newer; test decoding of known-good and edge-case PNM files post-upgrade; review build logs for the referenced commit.

Typical attack path

1. Identify target systems accepting or processing PNM images via FFmpeg
2. Craft specially malformed PNM file exploiting the heap overflow
3. Deliver file over network or via file upload to trigger decoding
4. Achieve memory corruption for code execution or service disruption

How to detect it

Review application and system logs for FFmpeg process crashes or segmentation faults during PNM decoding; correlate with file upload or media processing events; inspect for anomalous memory allocations in media pipelines.

What your security team should do

• Prioritize upgrade of all FFmpeg instances to 7.0.2 within 30 days
• Inventory and update downstream applications using FFmpeg
• Implement input validation or sandboxing around media decoding
• Monitor EPSS trend and public exploit availability for increased urgency