CVE-2022-48434: Use After Free
libavcodec/pthreadframe.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-48434?
CVE-2022-48434 is a vulnerability in FFmpeg before 5.1.2 that allows attackers to trigger a use-after-free and execute arbitrary code.
What software is affected by CVE-2022-48434?
FFmpeg before version 5.1.2, as well as VLC and other products that use FFmpeg, are affected by CVE-2022-48434.
What is the severity of CVE-2022-48434?
CVE-2022-48434 has a severity score of 8.1, which is considered high.
How can the CVE-2022-48434 vulnerability be exploited?
Attackers can exploit CVE-2022-48434 by triggering a use-after-free and executing arbitrary code, typically by manipulating mid-video SPS changes when hardware is re-initialized.
How can I fix CVE-2022-48434?
To fix CVE-2022-48434, update FFmpeg to version 5.1.2 or later.