StackPatch is liveSee product

Back to CVE digest
CVE-2024-36617 · cross-distro fix matrix

CVE-2024-36617: It was discovered that the FFmpeg CAF decoder incorrectly handled certain

Affects 5 Linux releases across 28 (distro × package) combinations. First disclosed: 2026-05-28.

Fix per ecosystem

Each block below is a distro release where CVE-2024-36617 has a known fix. Run the listed command on that distro to remediate.

Ubuntu noble

Source: Ubuntu USN

  • ffmpeg→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y ffmpeg
  • ffmpeg-doc→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y ffmpeg-doc
  • libavcodec-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavcodec-dev
  • libavcodec-extra→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavcodec-extra
  • libavcodec-extra60→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavcodec-extra60
  • libavcodec60→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavcodec60
  • libavdevice-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavdevice-dev
  • libavdevice60→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavdevice60
  • libavfilter-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavfilter-dev
  • libavfilter-extra→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavfilter-extra
  • libavfilter-extra9→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavfilter-extra9
  • libavfilter9→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavfilter9
  • libavformat-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavformat-dev
  • libavformat-extra→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavformat-extra
  • libavformat-extra60→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavformat-extra60
  • libavformat60→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavformat60
  • libavutil-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavutil-dev
  • libavutil58→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libavutil58
  • libpostproc-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libpostproc-dev
  • libpostproc57→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libpostproc57
  • libswresample-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libswresample-dev
  • libswresample4→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libswresample4
  • libswscale-dev→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libswscale-dev
  • libswscale7→ fixed in7:6.1.1-3ubuntu5+esm8USN-8329-1
    sudo apt-get install --only-upgrade -y libswscale7

Debian bullseye

Source: Debian Security Tracker

  • ffmpeg→ fixed in7:4.3.7-0+deb11u1urgency: not yet assigned
    sudo apt-get install --only-upgrade -y ffmpeg

Debian bookworm

Source: Debian Security Tracker

  • ffmpeg→ fixed in7:5.1.5-0+deb12u1urgency: not yet assigned
    sudo apt-get install --only-upgrade -y ffmpeg

Debian trixie

Source: Debian Security Tracker

  • ffmpeg→ fixed in7:7.0.1-3urgency: not yet assigned
    sudo apt-get install --only-upgrade -y ffmpeg

Alpine edge

Source: Alpine secdb

  • ffmpeg→ fixed in7.1.1-r0
    apk update && apk add --upgrade ffmpeg
Are YOU affected by CVE-2024-36617?

5-second check on your actual server. Reads /etc/os-release, uname -r, and the distro's package manager; matches against this same cross-source index live.

curl https://mindsparkstack.com/scan.sh | bash
Continuous monitoring beats manual checking

CVE-2024-36617dropped silently in your distro's update channel. Every new CVE is the same story. StackPatch runs the matcher hourly against all 5 sources and emails the exact remediation when something new applies to one of your servers. From $9/mo, 14-day free trial, cancel anytime.

See StackPatch (from $9/mo)