6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-36618

CVE-2024-36618: FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for...

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-36618

CVE-2024-36618:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The provided commit patch directly modifies the check_stream_max_drift function in libavformat/avidec.c. The change from 1LU to 1ULL in the loop condition pos = min_pos + 1LU is specifically to address an integer overflow. This indicates that the check_stream_max_drift function was the site of the vulnerability. The vulnerability description confirms an integer overflow in the AVI demuxer, and this function is part of that demuxer. The confidence is high because the patch directly addresses the integer overflow within this function, and the commit message explicitly states this fixes an integer overflow issue related to ULONG_MAX < INT64_MAX scenarios, which aligns with the vulnerability description of an integer overflow in the AVI demuxer leading to a DoS. The function signature check_stream_max_drift is what would appear in a runtime profile when this code path is executed during the processing of a malicious AVI file designed to trigger this overflow condition.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.