CVE-2023-48727

What it actually does

NULL pointer dereference in Intel oneVPL allows local authenticated users to read sensitive memory contents.

Why it matters to the business

Local users may access information that should remain confidential, increasing risk of data leakage on systems running the affected media processing library.

How an attack unfolds

An authenticated local user invokes oneVPL functions with inputs that trigger the NULL dereference, resulting in partial memory disclosure without requiring elevated privileges or network access.

How to fix it

Upgrade Intel oneVPL to version 23.3.5 or later on all affected systems.

How to confirm the fix worked

Verify the installed oneVPL version is 23.3.5 or newer using vendor-provided version checks or package managers.

Typical attack path

1. Obtain local authenticated access to the target system
2. Load or invoke the vulnerable oneVPL code path
3. Supply crafted input that dereferences a NULL pointer
4. Observe disclosed memory contents

How to detect it

Review local process execution and library load logs for unexpected oneVPL usage patterns; examine memory dumps or application crashes that reference oneVPL for signs of NULL dereference handling.

What your security team should do

• Apply the 23.3.5 update immediately on all systems using oneVPL
• Restrict local access to systems running the library until patched
• Monitor for any local privilege-escalation attempts that could leverage the disclosed information