CVE-2024-36615

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-36615
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36615.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-36615
Downstream
Related
Published
2024-11-29T00:00:00Z
Modified
2026-08-04T17:04:23.994019Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36615.json"
}
References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type
GIT
Repo
https://git.ffmpeg.org/ffmpeg.git
Events
Introduced
083443d67cb159ce469e5d902346b8d0c2cd1c93
Last affected
083443d67cb159ce469e5d902346b8d0c2cd1c93
Database specific 
{
    "extracted_events": [
        {
            "introduced": "7.0"
        },
        {
            "last_affected": "7.0"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:7.0:*:*:*:*:*:*:*"
}

Affected versions

7.*
7.0
n7.*
n7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36615.json"

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0ba058579f332b3060d8470a04ddd3fbf305be61
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

Other
N
n0.*
n0.11-dev
n0.12-dev
n0.8
n1.*
n1.1-dev
n1.2-dev
n1.3-dev
n2.*
n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev
n3.5-dev
n4.*
n4.1-dev
n4.2-dev
n4.3-dev
n4.4-dev
n4.5-dev
n5.*
n5.1-dev
n5.2-dev
n6.*
n6.1-dev
n6.2-dev
n7.*
n7.1-dev

Database specific

vanir_signatures_modified 
"2026-08-04T17:04:23Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36615.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "libavcodec/vp9.c"
        },
        "id": "CVE-2024-36615-711d8270",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "335372490738671505369724182254531041358",
                "127935918616120087823486240640612650771",
                "142323770510189586889619665783444845507",
                "45284856373428535342396139929615234043",
                "142229536224802899673542715021971453843",
                "175174521360538139367317829246283952766",
                "4472253933098053916888779846008430051",
                "316734082837480305364479477828994035890",
                "23466475118872071879769195409857382566",
                "319439282671016077836651778039992486975",
                "195227560335120158004437394736265210786",
                "107043060073689191139734471039878542009",
                "43512771917042668951682315554863543537",
                "80400429131705607110080330649464797297",
                "133461771431000468769775978014958969048",
                "220889737768823718366930779482888751041",
                "16699427622736519744943646276138935950",
                "70536755975377561454931613614243141973",
                "225445499080665327927535202886746257142",
                "106405627162966505925675949535580262338",
                "136871351956682855118878614421738178294",
                "72332549859910042828467466376498584432",
                "194425828275613009927530676027193037548",
                "292181177555336973886015917697509749619",
                "214458693370656173405146946334051101860",
                "7866441006196485450554987271389423764",
                "336827735829244440589123590071041938217",
                "18644247126023547669098045349579719722",
                "232666750874083941178246185749465165937"
            ]
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "function": "vp9_decode_frame",
            "file": "libavcodec/vp9.c"
        },
        "id": "CVE-2024-36615-db7c6038",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61",
        "signature_version": "v1",
        "digest": {
            "function_hash": "250631083245688050283878552280104948723",
            "length": 7208.0
        }
    }
]