CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-22860: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component...
Description
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
Classification
CVE ID: CVE-2024-22860
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 1.86% (probability of being exploited)
EPSS Percentile: 82.19% (scored less or equal to compared to others)
EPSS Date: 2025-06-14 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: total
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-22860https://github.com/FFmpeg/FFmpeg/commit/d2e8974699a9e35cc1a926bf74a972300d629cd5
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61991