CVE-2020-22035: 
Ffmpeg vulnerability analysis and mitigation

A heap-based Buffer Overflow vulnerability was identified in FFmpeg 4.2, specifically in the get_block_row function within libavfilter/vf_bm3d.c. The vulnerability was assigned CVE-2020-22035 and was publicly disclosed in June 2021 (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 Base Score of 8.8 (HIGH). The technical analysis revealed that the issue occurs in the get_block_row function of libavfilter/vf_bm3d.c, which could lead to memory corruption when processing certain inputs (FFmpeg Ticket).

The exploitation of this vulnerability could potentially lead to memory corruption and other unspecified consequences. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires network access and user interaction to exploit. A proof of concept (PoC) demonstrating the heap-buffer-overflow was submitted to the FFmpeg issue tracker, confirming the exploitability of the issue (FFmpeg Ticket).

The vulnerability has been fixed in subsequent releases. Debian released security updates to address this issue in version 7:4.1.8-0+deb10u1 for the oldstable distribution (buster). Users are recommended to upgrade their FFmpeg packages to the patched versions (Debian Advisory).