CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

CVE-2024-4978 affects the Justice AV Solutions (JAVS) Viewer installer by embedding malicious code. The installer includes a malicious version of ffmpeg.exe named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When that component runs, it establishes a backdoor connection to a malicious command-and-control server.

This is a supply-chain style risk for any environment that has installed or run the affected Viewer software. Unauthorized remote access can follow simply from executing the installer, so teams that use JAVS products for recording or playback should treat the issue as high priority and confirm all details against the vendor advisory.

How it works

The weakness is classified as CWE-506, Embedded Malicious Code. Rather than a classic memory-corruption or authentication bypass, the installer itself ships a trojanized binary. The file fffmpeg.exe is present in the package; once executed it opens a backdoor channel to an attacker-controlled C2 server. An adversary does not need to craft additional exploit payloads after the installer has been run—the malicious code is already resident and active. Exact command-and-control protocols or persistence mechanisms are not detailed in the available summary; defenders should assume the backdoor provides remote control and treat any observed network activity from the binary as hostile.

Am I affected? How to find it in your systems

Justice AV Solutions Viewer is typically deployed on workstations or servers used for audio-visual capture, review, and playback—commonly in legal, courtroom, or evidence-management environments. Inventory steps include:

• Search endpoints and application directories for the JAVS Viewer product and any installer packages that may still be present.
• Locate files named fffmpeg.exe and compute their SHA256 hash; match against 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4.
• Review software inventory tools, package managers, and deployment logs for any historical installation of the Viewer.
• Examine network telemetry for unexpected outbound connections originating from processes associated with the Viewer or the named binary.

Exact version ranges and configuration prerequisites are not provided in the summary; confirm them directly against the vendor advisory before declaring systems clean or affected.

How to remediate

Follow the CISA-required action: apply mitigations per the vendor’s instructions. If the vendor has released an updated, clean installer or patch, deploy it immediately and verify that the malicious fffmpeg.exe is no longer present. If no mitigations are available, discontinue use of the product. After remediation, re-image or thoroughly clean any host that ran the tainted installer, rotate credentials that may have been exposed, and validate that no residual backdoor processes remain. Confirm the precise remediation steps and any replacement binaries against the official vendor advisory.

If you can't patch immediately

Until a clean vendor package can be applied or the product can be removed, reduce exposure with compensating controls:

• Isolate systems that have run the Viewer onto tightly controlled network segments with no unrestricted outbound internet access.
• Block or alert on the known malicious hash and any process named fffmpeg.exe via endpoint detection and response tools.
• Implement egress filtering or a web application firewall / proxy rule set that denies unexpected C2-style connections; monitor for anomalies from the Viewer process tree.
• Disable or uninstall the Viewer where operationally feasible, and restrict execution of any remaining installer packages via application allow-listing.
• Increase logging of process creation, network connections, and file writes on affected hosts so that any backdoor activity can be detected quickly.

These measures lower risk but do not eliminate the embedded code; plan for full remediation as soon as the vendor guidance permits.

If your data may have been exposed

Vulnerabilities that install backdoors can lead to broader compromise and data exposure. Review logs for signs of C2 communication or lateral movement, preserve forensic evidence, and follow your incident-response plan. Known ransomware use of this specific CVE is not documented. As a further check, you can run a free exposure scan of organizational email addresses against known breach data sets to determine whether any credentials or personal information have already appeared in public dumps.