CVE-2022-48434 Use after free in n/a

High 8.1 Published 29 Mar 2023 Updated 21 Oct 2024

Attackers can trigger a use-after-free in FFmpeg's hardware acceleration handling to execute arbitrary code, particularly when using Direct3D11.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-48434?

CVE-2022-48434 is a high-severity use after free vulnerability in Ffmpeg Ffmpeg, published on 29 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

Weakness: CWE-416

Which versions are affected by CVE-2022-48434?

It affects 1 product.

Linux distribution packages (18)

`ffmpeg` SUSE:Enterprise Storage 7	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Enterprise Storage 7.1	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`3.4.2-150200.11.28.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`4.4-150400.3.15.1`
`ffmpeg` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`3.4.2-150200.11.28.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`4.4-150400.3.15.1`
`ffmpeg` SUSE:Linux Enterprise Real Time 15 SP3	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`3.4.2-150200.11.28.1`
`ffmpeg` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`3.4.2-150200.11.28.1`
`ffmpeg-4` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`4.4-150400.3.15.1`
`ffmpeg` openSUSE:Leap 15.4	All versions	`3.4.2-150200.11.28.1`
`ffmpeg-4` openSUSE:Leap 15.4	All versions	`4.4-150400.3.15.1`

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2022-48434?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-48434 being exploited?

There is no known exploitation of CVE-2022-48434 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-48434, GHSA-q56j-8x89-gvgg, JLSEC-2025-123, SUSE-SU-2023:2087-1, SUSE-SU-2023:2108-1, UBUNTU-CVE-2022-48434.