CVE-2024-36615

low-risk

Published 2024-11-29

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Ffmpeg

Affected Vendors

Ffmpeg

References (3)

Third Party Advisory https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb

Product https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738

Patch https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal