Cloudanix VulnDB

CVE-2022-38864

Medium · 5.5

CVSS

5.5

EPSS

0.4%

Published

Sep 15, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in an older media player can make the program crash if someone opens a specially made video file on the same computer.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow in mp_unescape03() within libmpdemux/mpeg_hdr.c allows local processing of a crafted MPEG stream to crash the process (high availability impact, no confidentiality or integrity loss).

Why it matters to the business

Media playback or encoding jobs using the affected mplayer/mencoder builds can be interrupted by crafted files, causing workflow disruption for organizations that rely on these tools; no ransomware or nation-state campaigns are associated and exploitation remains low-probability.

How an attack unfolds

An attacker prepares an MPEG file containing a specially formed header that overflows the buffer inside mp_unescape03, then convinces a user to open the file locally with the vulnerable mplayer or mencoder binary; the overflow triggers a crash, satisfying the observed CVSS availability impact.

How to fix it

Upgrade affected mplayer and mencoder installations to a build containing one of the listed fixed commits (a3843921ae3d45cc7603ffa3e2f7e9014de119bf or b5d5504ad3440d4005a2710f6e45ae989b0a49d3); rebuild from source if pre-built packages are unavailable.

How to confirm the fix worked

Confirm the running binary reports a version or commit newer than the listed fixes; test by attempting to play a known-triggering MPEG sample and verifying the process no longer crashes.

Typical attack path

  1. Generate a malicious MPEG file that triggers the overflow in mp_unescape03
  2. Deliver the file to the target via email, download link, or removable media
  3. Victim opens the file with the vulnerable mplayer or mencoder binary
  4. Application crashes due to memory corruption

How to detect it

Search application or system logs for unexpected mplayer/mencoder process terminations while handling MPEG files; no public exploit artifacts or threat-actor TTPs are known for this issue.

What your security team should do

  • Identify all systems running mplayer or mencoder SVN-r38374-13.0.1 or older and schedule upgrades within normal change windows
  • Add the vulnerable commit hashes to internal package blacklists until patched builds are deployed
  • Review media-handling workflows for opportunities to replace mplayer with a maintained alternative

The record

Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 mplayer 0 2:1.3.0-8+deb10u1
Debian:11 mplayer 0 2:1.4+ds1-1+deb11u1
Debian:12 mplayer 0 2:1.5+svn38408-1
Debian:13 mplayer 0 2:1.5+svn38408-1
Mageia:9 mplayer 0 1.5-12.1.mga9
Mageia:9 mplayer 0 1.5-12.1.mga9.tainted
Ubuntu:18.04:LTS mplayer 0 2:1.3.0-7ubuntu0.2
Ubuntu:20.04:LTS mplayer 0 2:1.3.0-8+deb10u1build0.20.04.1
Ubuntu:22.04:LTS mplayer 0 2:1.4+ds1-3ubuntu0.1
Ubuntu:Pro:16.04:LTS mplayer 0 2:1.2.1-1ubuntu1.1+esm1

Related vulnerabilities