CVE-2024-31581

The vulnerability results from lack of proper verification of the index value before using it to access an array element in the code handling H.266/VVC syntax. An attacker can provide specially crafted input data (e.g., malicious media file) that leads to reading or writing outside array bounds. This results in undefined behavior of the application, which can be further exploited.

An attacker can cause undefined behavior in the application, potentially resulting in data disclosure, integrity violation, or denial of service — high impact on system confidentiality, integrity, and availability.

FFmpeg should be updated to version n6.1.1 or later, in which the bug has been fixed (commit ce0c178a408d43e71085c28a47d50dc939b60196). Fedora distribution users should apply package updates according to announcements published on Fedora mailing lists.

FFmpeg in version n6.1 and Fedora distributions containing this version of FFmpeg package