OSV-2023-342 Heap-use-after-free in ih264_inter_pred_luma_vert_ssse3
A heap-use-after-free in the H.264 decoder allows attackers to execute arbitrary code or cause denial of service via crafted video files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is OSV-2023-342?
OSV-2023-342 is an use after free vulnerability in libavc, published on 24 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58278
Crash type: Heap-use-after-free READ 16
Crash state:
ih264_inter_pred_luma_vert_ssse3
ih264d_motion_compensate_mp
isvcd_decode_recon_tfr_nmb_non_base_lyr
Which versions are affected by OSV-2023-342?
1 open source package ship an affected version, including libavc.
| Package | Affected | Fixed in |
|---|---|---|
libavc OSS-Fuzz | All versions | None |
How do I fix OSV-2023-342?
No fix has been published for OSV-2023-342 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is OSV-2023-342 being exploited?
There is no known exploitation of OSV-2023-342 in the wild and no public exploit code.