CVE-2022-38861

What it actually does

Memory corruption triggered through the free_mp_image() function in libmpcodecs/mp_image.c when processing crafted media input.

Why it matters to the business

Application instability or denial of service on systems that play media with the affected player, with potential for further compromise if memory corruption is leveraged.

How an attack unfolds

An attacker crafts a malicious media file designed to trigger the vulnerable free_mp_image() path; when a user opens the file locally with the affected player, the memory corruption occurs.

How to fix it

Upgrade MPlayer to a version newer than SVN-r38374-13.0.1; Debian users should apply any available security updates for the mplayer package or migrate to an unaffected media player.

How to confirm the fix worked

Verify the installed MPlayer version is newer than the vulnerable SVN revision; attempt playback of known triggering media files in a controlled environment to confirm absence of crashes.

Typical attack path

1. Craft a malicious media file that exercises the free_mp_image() code path with invalid data
2. Deliver the file to the target via email, download, or removable media
3. Victim opens the file using the vulnerable MPlayer binary
4. Memory corruption occurs, potentially leading to crash or further exploitation

How to detect it

Review system and application logs for MPlayer segmentation faults or abnormal termination when processing media files; examine crash dumps or core files for references to mp_image.c.

What your security team should do

• Prioritize removal or replacement of MPlayer on any systems that handle untrusted media
• Monitor vendor or distribution advisories for backported fixes
• Restrict execution of legacy media players through application allow-listing