FFmpeg · Ffmpeg · CVE-2022-48434
**Name of the Vulnerable Software and Affected Versions**
FFmpeg versions prior to 5.1.2
**Description**
The issue is related to the use of memory after it has been freed in the libavcodec/pthread frame.c component of the FFmpeg multimedia library when handling worker threads with the hwaccel decoder. This can allow a remote attacker to execute arbitrary code in certain circumstances, such as during hardware re-initialization upon a mid-video SPS change when Direct3D11 is used.
**Recommendations**
For FFmpeg versions prior to 5.1.2, update to version 5.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of hwaccel decoder in worker threads until a patch is available. Restrict access to the libavcodec/pthread frame.c component to minimize the risk of exploitation. Avoid using the hwaccel state in worker threads in the affected API endpoints until the issue is resolved.