CVE-2024-36613
📋 TL;DR
FFmpeg versions containing the vulnerable DXA demuxer in libavformat have an integer overflow vulnerability that can cause denial-of-service (DoS) or undefined behavior when processing malicious DXA video files. This affects any application or service that uses FFmpeg to process DXA format video files. The vulnerability is in the parsing logic and can be triggered by feeding specially crafted DXA files to FFmpeg.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution (RCE) through memory corruption leading to complete system compromise, though this is less likely given the CWE-190 classification.
Likely Case
Denial-of-service (DoS) causing FFmpeg process crashes or system instability when processing malicious DXA files.
If Mitigated
Process isolation limits impact to the FFmpeg instance; proper input validation prevents exploitation.
🎯 Exploit Status
Proof-of-concept exists in the GitHub gist reference; exploitation requires feeding a malicious DXA file to FFmpeg.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 50d8e4f27398fd5778485a827d7a2817921f8540 and later versions
Vendor Advisory: https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540
Restart Required: No
Instructions:
1. Update FFmpeg to version after commit 50d8e4f27398fd5778485a827d7a2817921f8540. 2. Recompile if using source. 3. Replace binary if using pre-built packages.
🔧 Temporary Workarounds
Disable DXA demuxer
allDisable DXA format support in FFmpeg to prevent processing of vulnerable file type
ffmpeg -formats | grep dxa
Recompile FFmpeg with --disable-demuxer=dxa
Input validation
linuxImplement file type validation before passing to FFmpeg to reject DXA files
Use file command or magic bytes detection: file --mime-type input.dxa
🧯 If You Can't Patch
- Isolate FFmpeg processes in containers or sandboxes to limit blast radius
- Implement strict input validation to reject DXA files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: ffmpeg -version | grep 'version' and compare to n6.1.1 or earlierCheck Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify FFmpeg version is after commit 50d8e4f27398fd5778485a827d7a2817921f8540 or test with known malicious DXA file📡 Detection & Monitoring
Log Indicators:
- FFmpeg process crashes with segmentation faults
- Error logs containing 'dxa.c' or 'libavformat' failures
Network Indicators:
- Unusual uploads of DXA format files to video processing services
SIEM Query:
process.name:ffmpeg AND (event.action:crash OR log.level:error)