CVE-2023-51791

What it actually does

Local buffer overflow in the gen_alias_map function of libavcodec/jpegxl_parser.c allows an attacker to overwrite memory and execute arbitrary code when parsing specially crafted JPEG XL data.

Why it matters to the business

Systems that process untrusted media files with FFmpeg can be fully compromised by a local user, leading to unauthorized code execution, data theft, or persistence on the affected host.

How an attack unfolds

A local attacker supplies a malformed JPEG XL stream that reaches the vulnerable alias map generation routine; the overflow corrupts adjacent stack or heap structures, allowing the attacker to redirect control flow and execute attacker-supplied code within the FFmpeg process context.

How to fix it

Upgrade FFmpeg to a version that contains the corrected jpegxl_parser implementation; until then, avoid processing untrusted JPEG XL content and run FFmpeg under the lowest possible privileges.

How to confirm the fix worked

Confirm the installed FFmpeg build no longer contains the vulnerable gen_alias_map routine by inspecting source or binary symbols, and test with known-triggering JPEG XL samples in a controlled environment.

Typical attack path

1. Obtain local access or ability to supply media input to an FFmpeg-based application
2. Craft a JPEG XL file or stream that triggers the buffer overflow in gen_alias_map
3. Cause the target application to parse the malicious input
4. Leverage the resulting memory corruption to achieve arbitrary code execution

How to detect it

Review application and system logs for segmentation faults or abnormal terminations in FFmpeg processes that handle JPEG XL content; correlate with file creation or access events involving suspicious media files.

What your security team should do

• Prioritize patching FFmpeg across all media-processing pipelines
• Restrict which users and services can invoke FFmpeg on untrusted input
• Enable address space layout randomization and other memory protections on hosts running FFmpeg
• Monitor for unexpected crashes or high-severity alerts in media-handling services