CVE-2024-55069: 
Ffmpeg vulnerability analysis and mitigation

A Null Pointer Dereference vulnerability was identified in FFmpeg version 7.1, specifically in the iamfreadheader function within the /libavformat/iamfdec.c file. The vulnerability was discovered by 苏童 from SEU and was publicly disclosed on May 2, 2025 (Wiz Report).

The vulnerability manifests when processing ambisonics mode greater than 1, where layer 0 is unconditionally dereferenced while no layer initialization occurs. This issue was identified as poc-2024-11 in the FFmpeg project. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD, Wiz Report).

When exploited, this vulnerability can result in application crashes, potentially leading to denial of service conditions when processing specific media files that contain certain ambisonics mode configurations (Wiz Report).

The vulnerability has been addressed through a patch that adds validation to reject ambisonics mode values greater than 1. For Debian systems, the fix has been implemented in version 7.1.1-1 for Debian 13, while Debian 11 and 12 are not affected as they don't contain the vulnerable code (Debian Tracker, Wiz Report).