CVE-2024-22861: 
Ffmpeg vulnerability analysis and mitigation

Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. The vulnerability was discovered and disclosed on January 27, 2024, and is tracked as CVE-2024-22861. The vulnerability affects FFmpeg versions prior to 6.1 (NVD, CVE).

The vulnerability is classified as an Integer Overflow or Wraparound (CWE-190) issue. It has received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability specifically occurs in the avcodec/osq module where an integer overflow condition can be triggered (NVD).

When successfully exploited, this vulnerability can lead to a denial of service (DoS) condition, affecting the availability of the system. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, the availability impact is rated as High (Ubuntu).

The vulnerability has a network attack vector (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and no user interaction (UI:N). This combination of factors makes the vulnerability relatively easy to exploit from a network context (Ubuntu).

The vulnerability has been fixed in FFmpeg version 6.1 and later. Users are advised to upgrade to FFmpeg version 6.1 or newer to mitigate this vulnerability. A patch has been made available through the official FFmpeg repository (FFmpeg Patch).