CVE-2022-32317

MEDIUM

MPlayer 1.5 - Denial of Service via Heap Use-After-Free in vo_v4l2 Preinit Function

Title source: llm
STIX 2.1

Description

The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerability can lead to a Denial of Service (DoS) via a crafted file. The device=strdup statement is not executed on every call. Note: This has been disputed by third parties as invalid and not reproduceable.

References (3)

Core 3
Core References
Exploit, Third Party Advisory
https://github.com/b17fr13nds/MPlayer_cve_poc
Broken Link, Exploit, Third Party Advisory
https://transfer.sh/m2WcuM/poc_dup.zip

Scores

CVSS v3 5.5
EPSS 0.0076
EPSS Percentile 50.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-416
Status published
Products (1)
mplayerhq/mplayer 1.5
Published Jul 14, 2022
Tracked Since Feb 18, 2026