Skip to content
Fencer Vulns
critical 9.8

CVE-2024-35368 json

FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

published 2024-11-29 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-35746

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

Patch / fix

  • ffmpeg Debian 12 7:5.1.7-0+deb12u1
  • ffmpeg Debian 14, Debian 13 7:7.1-3

debian advisories DEBIAN-CVE-2024-35368

  • ffmpeg Ubuntu Pro 18.04 LTS 7:3.4.11-0ubuntu0.1+esm10
  • ffmpeg Ubuntu Pro 20.04 LTS 7:4.2.7-0ubuntu0.1+esm10
  • ffmpeg Ubuntu Pro 22.04 LTS 7:4.4.2-0ubuntu0.22.04.1+esm9
  • ffmpeg Ubuntu Pro 24.04 LTS 7:6.1.1-3ubuntu5+esm5

ubuntu advisories UBUNTU-CVE-2024-35368

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ffmpeg-4 SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 4.4.7-150600.13.47.1
  • ffmpeg-4 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 4.4.7-150400.3.67.1
  • ffmpeg SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 3.4.2-150200.11.60.1
  • ffmpeg-4 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 4.4.5-150400.3.46.1
  • ffmpeg-4 SLE Workstation Extension 15 SP6, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.4.5-150600.13.16.1

suse advisories SUSE-SU-2026:2445-1SUSE-SU-2026:2444-1SUSE-SU-2025:1450-1SUSE-SU-2025:1128-1SUSE-SU-2025:0862-1

  • ffmpeg-6 openSUSE Tumbleweed 6.1.2-3.1
  • ffmpeg-4 openSUSE Tumbleweed 4.4.5-5.1
  • ffmpeg-7 openSUSE Tumbleweed 7.1-4.1

opensuse advisories openSUSE-SU-2025:15010-1openSUSE-SU-2025:14849-1openSUSE-SU-2025:14850-1

  • ffmpeg Alpine 3.24, Alpine 3.23 7.1.1-r0

alpine advisories ALPINE-CVE-2024-35368

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.