CVE-2024-35369

MEDIUM

FFmpeg n6.1.1 - Integer Overflow in Speex Extradata Parsing

Title source: llm
STIX 2.1

Description

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

Scores

CVSS v3 5.5
EPSS 0.0024
EPSS Percentile 14.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-190
Status published
Products (1)
ffmpeg/ffmpeg 6.1.1
Published Nov 29, 2024
Tracked Since Feb 18, 2026