CVE-2024-36615

5.9 mediumEPSS 0.4%

Medium (5.9) in ffmpeg ffmpeg. EPSS 0.4% chance of exploitation in the next 30 days.

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2024-11-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ffmpeg:ffmpeg

References

https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb
https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738
https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61

Check your stack JSON