CVE-2024-32228: 
Ffmpeg vulnerability analysis and mitigation

FFmpeg 7.0 is affected by a buffer overflow vulnerability that causes a segmentation fault (SEGV) in the hevcframeend function at libavcodec/hevcdec.c:2947:22. The vulnerability was discovered and reported by Zeng Yunxiang (FFmpeg Ticket).

The vulnerability manifests as a segmentation fault caused by a READ memory access attempting to read from address 0x000000000000, indicating a null pointer dereference. The issue occurs specifically in the HEVC (High Efficiency Video Coding) decoder component of FFmpeg. The vulnerability has been assigned a CVSS 3.1 Base Score of 6.6 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H (NVD).

The vulnerability can lead to a denial of service condition through application crash when processing specially crafted HEVC video content. The CVSS scoring indicates potential impacts on confidentiality, integrity, and high impact on availability of the affected system (NVD).

The vulnerability has been fixed in FFmpeg through commit 459648761f5412acdc3317d5bac982ceaa257584. Users are advised to upgrade to the patched version. For systems that cannot be immediately upgraded, avoiding processing untrusted HEVC video content is recommended (FFmpeg Ticket).