PT-2024-6572 · FFmpeg · Ffmpeg
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Ffmpeg version N113007-g8d24a28d06
Description:
The issue is related to a buffer overflow in the libavcodec/jpegxl parser.c file, specifically in the
gen alias map function. This can allow a local attacker to execute arbitrary code, potentially leading to information disclosure.Recommendations:
For Ffmpeg version N113007-g8d24a28d06, consider disabling the
gen alias map function in the libavcodec/jpegxl parser.c file as a temporary workaround until a patch is available. Restrict access to the vulnerable libavcodec/jpegxl parser.c module to minimize the risk of exploitation.Exploit
Fix
Stack Overflow
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ffmpeg