CVE-2024-36618 Integer overflow in n/a

What is CVE-2024-36618?

CVE-2024-36618 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 29 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.

Weakness: CWE-190

Which versions are affected by CVE-2024-36618?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2024-36618?

Upgrade to a fixed version.

Is CVE-2024-36618 being exploited?

There is no known exploitation of CVE-2024-36618 in the wild and no public exploit code.

Other vulnerabilities in Ffmpeg Ffmpeg

• CVE-2013-0864 Memory corruption in n/a Critical 10.0
• CVE-2013-0872 Memory corruption in n/a Critical 10.0
• CVE-2013-0873 Memory corruption in n/a Critical 10.0
• CVE-2013-4265 Null dereference in n/a Critical 10.0
• CVE-2011-3937 Memory corruption in n/a Critical 10.0

All Ffmpeg Ffmpeg vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-36618, GHSA-f9m5-926v-fxw4, JLSEC-2025-137, UBUNTU-CVE-2024-36618.