CVE-2023-51798

What it actually does

A buffer overflow triggered by a floating point exception at libavfilter/vf_minterpolate.c:1078:60 allows local attackers to execute arbitrary code during video frame interpolation.

Why it matters to the business

Local attackers can achieve full system compromise, leading to data theft, malware installation, or lateral movement with minimal privileges required.

How an attack unfolds

A local attacker supplies a crafted media file that exercises the minterpolate filter; the floating point exception during processing overflows a buffer, enabling shellcode execution in the context of the FFmpeg process.

How to fix it

Upgrade FFmpeg to a patched release that resolves the buffer overflow in libavfilter/vf_minterpolate.c; rebuild any dependent applications against the fixed library.

How to confirm the fix worked

Confirm the installed FFmpeg version is newer than the vulnerable build; test processing of sample media files with the minterpolate filter to verify absence of crashes or unexpected behavior.

Typical attack path

1. Obtain local access to a system running vulnerable FFmpeg
2. Prepare a malicious media file designed to trigger the FPE path
3. Invoke FFmpeg with command-line options that enable the minterpolate filter
4. Trigger the exception at the vulnerable line to overflow the buffer
5. Execute attacker-supplied code for privilege escalation or persistence

How to detect it

Search process execution logs and crash reports for FFmpeg invocations involving the minterpolate filter followed by floating-point exceptions or segmentation faults.

What your security team should do

• Prioritize patching FFmpeg across all media-processing pipelines
• Limit execution of FFmpeg to least-privilege accounts and sandboxed environments
• Review and restrict use of the minterpolate filter in automated workflows
• Monitor systems for unusual child processes or crashes originating from FFmpeg