Use After Free Affecting ffmpeg-4-libavresample-devel package, versions <4.4.5-150600.13.19.1


Severity

Recommended
0.0
high
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.23% (47th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use After Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES156-FFMPEG4LIBAVRESAMPLEDEVEL-9486323
  • published20 Mar 2025
  • disclosed19 Mar 2025

Introduced: 19 Mar 2025

CVE-2022-48434  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade SLES:15.6 ffmpeg-4-libavresample-devel to version 4.4.5-150600.13.19.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ffmpeg-4-libavresample-devel package and not the ffmpeg-4-libavresample-devel package as distributed by SLES. See How to fix? for SLES:15.6 relevant fixed versions and status.

libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

CVSS Base Scores

version 3.1