libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

🗓️ 04 Sep 2025 00:15:51Reported by MicrosoftType

FFmpeg before 5.1.2 leaves stale acceleration state in workers, enabling use-after-free and execution.

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator for IBM Cloud Pak for Data is affected by multiple vulnerabilities.	19 Feb 202617:06	–	ibm
ATTACKERKB	CVE-2022-48434	29 Mar 202317:15	–	attackerkb
AstraLinux	Astra Linux – Vulnerability in ffmpeg	3 May 202623:59	–	astralinux
BDU FSTEC	The vulnerability in the `libavcodec/pthread_frame.c` component of the multimedia library FFmpeg, related to the use of memory after it is freed, allows a hacker to execute arbitrary code.	31 May 202300:00	–	bdu_fstec
Circl	CVE-2022-48434	29 Mar 202320:15	–	circl
CNNVD	FFmpeg 资源管理错误漏洞	29 Mar 202300:00	–	cnnvd
CNVD	Ffmpeg Resource Management Error Vulnerability (CNVD-2025-01694)	31 Mar 202300:00	–	cnvd
CVE	CVE-2022-48434	29 Mar 202300:00	–	cve
Cvelist	CVE-2022-48434	29 Mar 202300:00	–	cvelist
Debian	[SECURITY] [DSA 5721-1] ffmpeg security update	26 Jun 202418:27	–	debian