CVE-2024-36615

State: Published
Severity: 5.9 Medium
Published: Nov 29, 2024
Updated: Dec 3, 2024
Reserved: May 30, 2024

Description

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61
https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738
https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.