CVE-2024-32230: FFmpeg Buffer Overflow Vulnerability

CVE-2024-32230 Overview

CVE-2024-32230 is a buffer overflow vulnerability in FFmpeg 7.0 affecting the load_input_picture function within libavcodec/mpegvideo_enc.c. The flaw is a negative-size-param bug at line 1216:21 that mishandles image dimensions during MPEG video encoding. An attacker who convinces a user to process a crafted media file can trigger memory corruption, leading to code execution or process termination. The vulnerability is tracked under CWE-120: Buffer Copy without Checking Size of Input and requires local access with user interaction. FFmpeg is widely embedded in media players, transcoders, and server-side processing pipelines, expanding the potential attack surface.

Critical Impact
Local attackers can trigger memory corruption in FFmpeg 7.0 via crafted input, potentially resulting in arbitrary code execution with the privileges of the invoking user.

Affected Products

FFmpeg 7.0
Applications and services embedding FFmpeg 7.0 libraries (libavcodec)
Media transcoding pipelines and video encoders relying on mpegvideo_enc

Discovery Timeline

2024-07-01 - CVE-2024-32230 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32230

Vulnerability Analysis

The vulnerability resides in the load_input_picture function inside libavcodec/mpegvideo_enc.c at line 1216. During MPEG video encoder initialization, the function processes input picture parameters used to allocate and copy pixel buffers. A negative-size-param condition arises when a size argument passed to a memory copy or allocation routine is interpreted as a negative value.

When the size parameter is signed and becomes negative, downstream calls treat it as a very large unsigned integer. This mismatch produces an out-of-bounds write on the destination buffer. The result is heap or stack corruption inside the encoder path.

Exploitation requires the victim to open or transcode a specially crafted media input using FFmpeg 7.0. Successful memory corruption can compromise confidentiality, integrity, and availability of the local process. See the FFmpeg Ticket #10952 for the upstream tracker.

Root Cause

The root cause is missing validation of picture dimension parameters before they are passed to memory copy routines. The function accepts signed size values without bounding them to safe positive ranges. This falls under CWE-120, classic buffer copy without size checking.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious media file through email, file sharing, or a compromised web download. When the victim invokes FFmpeg 7.0 (directly or via an application embedding libavcodec) to process the file, the encoder path triggers the overflow. No network access or elevated privileges are required by the attacker.

No verified public proof-of-concept code is available. Refer to the FFmpeg upstream ticket for reproduction details and patch discussion.

Detection Methods for CVE-2024-32230

Indicators of Compromise

Unexpected crashes or segmentation faults in ffmpeg or applications linking libavcodec version 7.0.
Core dumps referencing load_input_picture or mpegvideo_enc.c in the stack trace.
Suspicious media files delivered from untrusted sources immediately preceding FFmpeg process crashes.

Detection Strategies

Inventory hosts running FFmpeg 7.0 and identify third-party applications that ship bundled FFmpeg binaries.
Monitor process telemetry for ffmpeg child processes spawning shells or writing to unusual locations after processing media inputs.
Enable AddressSanitizer or equivalent memory error detectors in test environments to reproduce and confirm the flaw during triage.

Monitoring Recommendations

Log command-line arguments and file inputs for FFmpeg invocations on servers performing automated transcoding.
Alert on abnormal termination signals (SIGSEGV, SIGABRT) from media-processing services.
Correlate media file downloads with subsequent FFmpeg execution to identify potential exploitation attempts.

How to Mitigate CVE-2024-32230

Immediate Actions Required

Identify all systems running FFmpeg 7.0 and applications that statically link or bundle the affected libavcodec version.
Restrict FFmpeg processing to trusted input sources until a fixed release is deployed.
Run FFmpeg under least-privilege accounts and within sandboxed environments such as containers or seccomp profiles.

Patch Information

At the time of publication, monitor the FFmpeg upstream ticket #10952 and official FFmpeg release channels for a fixed version. Upgrade to a patched FFmpeg release as soon as it becomes available and rebuild any downstream applications that statically link libavcodec.

Workarounds

Avoid processing untrusted media files with FFmpeg 7.0; validate file sources and formats before invocation.
Downgrade to a prior stable FFmpeg branch not affected by this specific regression if operational requirements permit.
Execute FFmpeg inside a restricted sandbox (for example, firejail, bubblewrap, or a container with no host filesystem access) to limit blast radius.
Disable MPEG encoding features in applications that do not require them.

bash

# Configuration example: run ffmpeg in a restricted sandbox
firejail --noprofile --net=none --private \
    ffmpeg -i /input/untrusted.mp4 -c:v libx264 /output/safe.mp4

# Verify installed version to confirm exposure
ffmpeg -version | head -n 1