CVE-2020-24995: Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows...

Security readout for executives and security teams

CVE-2020-24995 is a reported buffer overflow in FFmpeg 3.1.2. If a vulnerable local FFmpeg process handles a crafted media file, the issue is described as allowing arbitrary code execution. The source bundle does not provide a CVSS score, affected downstream products, or active exploitation evidence. Exposure is most likely where FFmpeg 3.1.2 is installed or embedded and processes untrusted AAC or media content locally. Downstream packages, appliances, and applications that bundle FFmpeg need separate vendor confirmation because the CVE record lists affected product metadata as unavailable. Prioritize systems that automatically process user-supplied media. Business urgency is moderate unless FFmpeg 3.1.2 is exposed through high-volume ingestion workflows or privileged local processing. Evidence is incomplete, so validation should come before emergency response. Mitigation focus: Inventory systems and applications using FFmpeg, especially version 3.1.2.; Check FFmpeg and distribution vendor guidance for fixed builds or backported patches.; Upgrade or replace vulnerable FFmpeg builds when a vendor-supported fix is available..

Prepared

Jun 3, 2026, 02:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.