CVE-2023-49502

What it actually does

Buffer overflow in ff_bwdif_filter_intra_c at libavfilter/bwdifdsp.c:125 allows memory corruption leading to arbitrary code execution.

Why it matters to the business

Compromise of systems processing video content with vulnerable FFmpeg can result in unauthorized code execution and full system takeover; the vulnerability is nearly three years old with low exploitation probability and no known ransomware or threat actor use.

How an attack unfolds

An attacker supplies a specially crafted media file that exercises the bwdif deinterlacing path; when FFmpeg processes the file the overflow occurs in the intra filter function, allowing the attacker to redirect control flow and execute arbitrary code.

How to fix it

Upgrade org/ffmpeg.git and ffmpeg/ffmpeg to commit 083443d67cb159ce469e5d902346b8d0c2cd1c93 or later.

How to confirm the fix worked

Confirm the installed FFmpeg source tree contains commit 083443d67cb159ce469e5d902346b8d0c2cd1c93 or a later equivalent; recompile and test the bwdif filter with known-good inputs.

Typical attack path

1. Create malicious media file triggering bwdif intra filter path
2. Deliver file to target environment via network share, email, or web
3. Victim application invokes FFmpeg to decode or filter the file
4. Buffer overflow overwrites memory and executes attacker-supplied code

How to detect it

Review FFmpeg process logs and crash reports for segmentation faults or assertions originating from bwdifdsp.c; correlate with file-processing timestamps and unexpected child processes spawned by FFmpeg.

What your security team should do

• Apply the listed commit immediately on all build and runtime FFmpeg instances
• Inventory media-processing pipelines and containers for the affected GIT revisions
• Add FFmpeg version checks to CI/CD and deployment pipelines
• Monitor EPSS and KEV updates for any future increase in exploit activity