ACTIVELY EXPLOITED
CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
| Vendor | Justice AV Solutions |
|---|---|
| Product | Viewer |
| Actively exploited | Yes |
| Added to CISA KEV | 29 May 2024 |
| CISA federal deadline | 19 Jun 2024 |
| Weakness (CWE) | CWE-506 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.