FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Dec 9, 2024 | Nov 29, 2024 |
| Ffmpeg | — | Upgrade to FFmpeg version 4.3.7Upgrade to FFmpeg version 5.1.5Upgrade to FFmpeg version 7.0 | Jun 5, 2025 | Nov 29, 2024 |
| Ubuntu | — | Upgrade libavcodec-dev (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro) | Jun 26, 2025 | Nov 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub