CVE-2024-35368 — CRITICAL (9.8)

Vulnerability Description

FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ffmpeg	Ffmpeg	7.0

Related Weaknesses (CWE)

CWE-415

References

https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5Third Party Advisory
https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466Product
https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53cPatch
https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html

FAQ

What is CVE-2024-35368?

CVE-2024-35368 is a vulnerability with a CVSS score of 9.8 (CRITICAL). FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

How severe is CVE-2024-35368?

CVE-2024-35368 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-35368?

Check the references section above for vendor advisories and patch information. Affected products include: Ffmpeg Ffmpeg.