CVE-2024-31582: FFmpeg Heap Buffer Overflow Vulnerability

CVE-2024-31582 Overview

CVE-2024-31582 is a heap buffer overflow vulnerability in FFmpeg version n6.1. The flaw resides in the draw_block_rectangle function of libavfilter/vf_codecview.c. Attackers can trigger undefined behavior or a Denial of Service (DoS) by supplying crafted input to the codecview filter. The issue is classified under CWE-122 (Heap-based Buffer Overflow). Successful exploitation requires local access and user interaction, such as processing an attacker-controlled media file through the affected filter. The vulnerability affects upstream FFmpeg builds and downstream Fedora 38, 39, and 40 packages.

Critical Impact
Processing a crafted input through the FFmpeg codecview filter can corrupt heap memory, crash the process, and potentially lead to further undefined behavior in the host application.

Affected Products

FFmpeg version n6.1
Fedora 38, 39, and 40 (ffmpeg package)
Applications and pipelines linking libavfilter from vulnerable FFmpeg builds

Discovery Timeline

2024-04-17 - CVE-2024-31582 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31582

Vulnerability Analysis

The vf_codecview filter in FFmpeg visualizes codec-level information such as motion vectors and block boundaries. The draw_block_rectangle function draws a rectangle around a coded block by writing color bytes to a frame buffer at computed offsets. When the block coordinates plus width extend beyond the frame's allocated buffer, the function writes past the heap-allocated region. This out-of-bounds write corrupts adjacent heap memory. Attackers exploit the flaw by supplying a crafted media file that produces block coordinates near or beyond the frame edge. The result is process instability, denial of service, or exploitable memory corruption depending on heap layout.

Root Cause

The root cause is missing bounds validation before writing pixel data. The final loop in draw_block_rectangle iterated x from sx to sx + w and wrote to buf[x] without confirming that sx + w remained within the row stride. The upstream patch in commit 99debe5f823f45a482e1dc08de35879aa9c74bd2 removes the offending loop entirely, since the preceding logic already handles the required rectangle edges.

Attack Vector

Exploitation requires local access and user interaction. An attacker must convince a user or automated pipeline to process a malicious input through FFmpeg with the codecview filter enabled. Typical scenarios include batch transcoding, forensic video inspection, and debugging workflows that visualize codec metadata. Remote exploitation is not directly possible without a wrapping application that exposes the filter to untrusted input.

         buf[sx + w - 1] = color;
         buf += stride;
     }
-
-    for (int x = sx; x < sx + w; x++)
-        buf[x] = color;
 }
 
 static int filter_frame(AVFilterLink *inlink, AVFrame *frame)

Source: FFmpeg Commit 99debe5f. The patch removes the trailing loop that wrote w bytes starting at sx without validating that the write remained within the frame buffer.

Detection Methods for CVE-2024-31582

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking libavfilter when the codecview filter is used
Heap corruption reports from AddressSanitizer or Valgrind referencing draw_block_rectangle in vf_codecview.c
Malformed media samples staged in transcoding, forensic, or media-analysis pipelines

Detection Strategies

Inventory installed FFmpeg versions and identify hosts running n6.1 or unpatched Fedora ffmpeg packages
Instrument test builds with AddressSanitizer to catch out-of-bounds writes when processing untrusted media
Monitor process telemetry for FFmpeg child processes terminating abnormally after invoking -vf codecview

Monitoring Recommendations

Log command-line arguments for FFmpeg invocations to identify use of the codecview filter with external input
Alert on repeated FFmpeg process crashes across a media processing fleet, which may indicate crafted-file DoS attempts
Track package versions via configuration management to detect drift from patched Fedora releases

How to Mitigate CVE-2024-31582

Immediate Actions Required

Update FFmpeg to a build that includes commit 99debe5f823f45a482e1dc08de35879aa9c74bd2 or later
Apply Fedora security updates announced through the Fedora Package Announcements list for Fedora 38, 39, and 40
Restrict FFmpeg processing of untrusted media to sandboxed or containerized environments

Patch Information

The fix is upstream in the FFmpeg repository. See the FFmpeg security commit for the code change. Fedora users should install the updated ffmpeg package via dnf update ffmpeg. Downstream distributions repackaging FFmpeg n6.1 should backport the patch to their maintained branches.

Workarounds

Disable use of the codecview filter in transcoding and inspection pipelines until patched
Run FFmpeg under a restricted user account with minimal filesystem and network access
Validate or transcode untrusted media through a hardened preprocessing step before applying diagnostic filters

bash

# Update FFmpeg on Fedora
sudo dnf update ffmpeg

# Verify installed version
ffmpeg -version

# Confirm the codecview filter is not applied to untrusted input
ffmpeg -filters | grep codecview