Integer overflow in FFmpeg - CVE-2024-22862

Vulnerability identifier: #VU92200

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22862

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system via the JJPEG XL Parser.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

FFmpeg
Telemetry Dashboard
IBM Watson Machine Learning Accelerator
Liquidware
Citrix Workspace App
Webex App VDI
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client

Install updates from vendor's website.

FFmpeg - update to 6.1
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
IBM Watson Machine Learning Accelerator - update to 5.0.3
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405

• https://github.com/FFmpeg/FFmpeg/commit/ca09d8a0dcd82e3128e62463231296aaf63ae6f7
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62113

• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data