{
  "cveId": "CVE-2024-35369",
  "url": "https://patchblox.com/security/cve/CVE-2024-35369",
  "summary": "CVE-2024-35369 is fixed in ffmpeg on 1 platform, first by DEBIAN-CVE-2024-35369, released November 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ffmpeg: In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exist...",
  "description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.",
  "published": "2024-11-29T17:15:07Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
  "epss": 0.00237,
  "epssPercentile": 0.1484,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ffmpeg",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "7:7.0.1-3",
      "fix": "DEBIAN-CVE-2024-35369",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35369",
      "released": "2024-11-29T17:15:07Z"
    },
    {
      "platform": "linux",
      "product": "ffmpeg",
      "release": "Debian 14",
      "fixedVersion": "7:7.0.1-3",
      "fix": "DEBIAN-CVE-2024-35369",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35369",
      "released": "2024-11-29T17:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}