CVE-2024-35368

9.8Critical

Published 29 Nov 2024 · NVD status: Modified · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-415

Impact

Remote attackers can potentially execute arbitrary code or crash the application by sending maliciously crafted media files to services parsing video via FFmpeg. No authentication or user interaction is required if processing is automated.

Root cause

A double-free vulnerability exists in the rkmpp_retrieve_frame function inside libavcodec/rkmppdec.c during video frame handling.

Affected systems

FFmpeg version n7.0.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Apply upstream patch commit 4513300989502090c4fd6560544dce399a8cd53c or upgrade your distribution packages to fixed builds. As an interim workaround, disable hardware-accelerated Rockchip MPP decoding (rkmpp).

shell

$ ffmpeg -version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

References

Source: nvd.nist.gov/vuln/detail/CVE-2024-35368