CVE-2024-31578: FFmpeg Heap Use-After-Free Vulnerability

CVE-2024-31578 Overview

CVE-2024-31578 is a heap use-after-free vulnerability [CWE-416] in FFmpeg version n6.1.1. The flaw resides in the av_hwframe_ctx_init function within libavutil/hwcontext.c. The function incorrectly assumes that frames_uninit is reentrant, leading to memory being freed and subsequently referenced when hardware frame context initialization fails.

Attackers can trigger the condition by supplying crafted media inputs that cause hardware frame initialization to fail. Successful exploitation primarily affects integrity, allowing memory corruption that may lead to process crashes or controlled write primitives.

Critical Impact
Remote attackers can corrupt heap memory in FFmpeg by supplying crafted media that fails hardware frame context initialization, potentially affecting integrity of any application embedding the vulnerable libavutil library.

Affected Products

FFmpeg n6.1.1
Fedora 38, 39, and 40
Debian distributions consuming the affected FFmpeg release

Discovery Timeline

2024-04-17 - CVE-2024-31578 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31578

Vulnerability Analysis

The vulnerability is a heap use-after-free [CWE-416] triggered during hardware frame context initialization. When av_hwframe_ctx_init invokes the frames_init callback and that callback returns an error, the original control flow jumped to a fail label that called frames_uninit. The cleanup routine was not safe to call multiple times, and a subsequent call from the destructor path operated on memory regions that had already been released.

The consequence is a dangling pointer being dereferenced during teardown of the hardware frame context. Any application or service that processes untrusted media through FFmpeg's hardware acceleration paths inherits the risk.

Root Cause

The root cause is an incorrect assumption that frames_uninit is reentrant. When frames_init failed inside av_hwframe_ctx_init, the code path executed cleanup logic twice: once through the local fail label and again through the standard reference-counted destructor when the caller released the frame context. The duplicated cleanup released the same heap allocations, leaving stale pointers that the second pass attempted to access.

Attack Vector

Exploitation requires no authentication and no user interaction beyond convincing a victim application to process a crafted input. Network-reachable services that transcode or analyze user-supplied media using FFmpeg's hardware acceleration backends represent the highest-risk targets. The publicly available proof-of-concept demonstrates the crash condition against ffmpeg builds compiled with hardware context support.

     if (ctx->internal->hw_type->frames_init) {
         ret = ctx->internal->hw_type->frames_init(ctx);
         if (ret < 0)
-            goto fail;
+            return ret;
     }
 
     if (ctx->internal->pool_internal && !ctx->pool)

Source: FFmpeg Commit 3bb00c0a — the patch replaces the goto fail branch with an early return ret, preventing the duplicated cleanup that produced the use-after-free.

Detection Methods for CVE-2024-31578

Indicators of Compromise

Unexpected ffmpeg or libavutil-linked process crashes with SIGSEGV or SIGABRT during media ingestion
Heap corruption messages from glibc such as double free or corruption or free(): invalid pointer in application logs
AddressSanitizer reports referencing av_hwframe_ctx_init or frames_uninit in the call stack
Repeated failed transcoding jobs originating from the same untrusted source

Detection Strategies

Inventory all installations of FFmpeg n6.1.1 and downstream packages on Fedora 38, 39, and 40, plus Debian LTS systems
Scan container images and CI pipelines for vulnerable libavutil versions linked into media-processing services
Monitor for abnormal child-process termination patterns in services that invoke ffmpeg for user-supplied content

Monitoring Recommendations

Forward FFmpeg stderr and crash dumps to a centralized log pipeline for correlation with input sources
Alert on repeated segmentation faults in transcoding workers within short time windows
Track outbound network behavior from media-processing hosts to identify post-crash anomalies

How to Mitigate CVE-2024-31578

Immediate Actions Required

Upgrade FFmpeg to a release containing commit 3bb00c0a420c3ce83c6fafee30270d69622ccad7 or later
Apply Fedora package updates referenced in the official Fedora Package Announcements
Apply the Debian LTS update on affected Debian systems
Rebuild and redeploy container images that statically link or bundle libavutil

Patch Information

The upstream fix is published in the FFmpeg repository as commit 3bb00c0a420c3ce83c6fafee30270d69622ccad7. The patch removes the assumption that frames_uninit can be invoked twice by returning the error code directly from av_hwframe_ctx_init instead of branching to the shared cleanup label. Distribution-specific updates are available through Fedora and Debian security channels listed in the vendor advisory.

Workarounds

Disable hardware-accelerated decoding paths by removing -hwaccel flags and avoiding AVHWFramesContext usage until patches are applied
Sandbox ffmpeg invocations using seccomp, bubblewrap, or container isolation to limit blast radius from heap corruption
Restrict media-processing services to authenticated, trusted input sources where feasible

bash

# Verify the installed FFmpeg version and confirm patch presence
ffmpeg -version | head -n1

# Fedora: apply security updates
sudo dnf update --refresh ffmpeg ffmpeg-libs

# Debian/Ubuntu: apply security updates
sudo apt update && sudo apt install --only-upgrade ffmpeg libavutil*