CVE-2023-22656
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5...
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
CVE-2023-22656- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-125, CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2023-26786
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
EUVD-2023-26786- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xh8-4cjj-qf63
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5...
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
GHSA-9xh8-4cjj-qf63- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
CVE-2023-22656- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-22656
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
DEBIAN-CVE-2023-22656- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-22656
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
UBUNTU-CVE-2023-22656- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSV No score
Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Record
CVE-2023-22656- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14936-1 No score
ffmpeg-4-4.4.5-9.1 on GA media
These are all security issues fixed in the ffmpeg-4-4.4.5-9.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14936-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14974-1 No score
ffmpeg-7-7.1.1-1.1 on GA media
These are all security issues fixed in the ffmpeg-7-7.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14974-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15010-1 No score
ffmpeg-6-6.1.2-3.1 on GA media
These are all security issues fixed in the ffmpeg-6-6.1.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15010-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20710-1 No score
Security update for ffmpeg-4
This update for ffmpeg-4 fixes the following issues:
Changes in ffmpeg-4:
-
CVE-2025-59728: Fixed out-of-bounds NUL-byte write when calculating the content path in handling of MPEG-DASH manifests (bsc#1251137).
-
CVE-2025-7700: Fixed a NULL Pointer Dereference in the ALS Decoder (bsc#1246790)
-
CVE-2024-36618: Fixed a integer overflow in AVI demuxer (bsc#1234020)
-
CVE-2023-6601: Fixed HLS Unsafe File Extension Bypass (bsc#1220545).
-
Update to release 4.4.6
- lavc/libx265: unbreak build for X265_BUILD >= 210
- ARM: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
- rtmpproto: Avoid rare crashes in the
fail:codepath in rtmp_open - avcodec/snow: Fix off by 1 error in run_buffer
- avcodec/mpegvideo_enc: Check FLV1 resolution limits
- Record
openSUSE-SU-2026:20710-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3198-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
- Record
SUSE-SU-2024:3198-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3289-1 No score
Security update for gstreamer-plugins-bad, libvpl
This update for gstreamer-plugins-bad, libvpl fixes the following issues:
- Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
The libmfx dependency is replaced by libvpl.
- Record
SUSE-SU-2024:3289-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3295-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
- Record
SUSE-SU-2024:3295-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3309-1 No score
Security update for libmfx
This update for libmfx fixes the following issues:
- CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
- CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
- CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
- CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
- CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)
- Record
SUSE-SU-2024:3309-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3339-1 No score
Security update for libmfx
This update for libmfx fixes the following issues:
- CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
- CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
- CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
- CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
- CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)
- Record
SUSE-SU-2024:3339-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3358-1 No score
Security update for ffmpeg-4
This update for ffmpeg-4 fixes the following issues:
- Dropped support for libmfx to fix the following CVEs:
- libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
- libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
- libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
- libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
- libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
- CVE-2024-7055: heap-based buffer overflow in pnmdec.c from the libavcodec library. (bsc#1229026)
- Record
SUSE-SU-2024:3358-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3397-1 No score
Security update for libmfx
This update for libmfx fixes the following issues:
- CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
- CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
- CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
- CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
- CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)
- Record
SUSE-SU-2024:3397-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0050-1 No score
Security update for libmfx
This update for libmfx fixes the following issues:
- CVE-2023-48368: Fixed an improper input validation. (bsc#1226897)
- CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898)
- CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899)
- CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900)
- CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901)
- Record
SUSE-SU-2025:0050-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
intel-mediasdkDebian:12 |
All versions, plus listed versions 22.5.4-1 |
None known |
onevpl-intel-gpuDebian:12 |
All versions, plus listed versions 22.6.4-123.2.3-124.3.3-124.3.4-125.1.2-1 Show 5 moreShow less25.1.4-125.3.1-126.1.2-126.1.2-1.126.3.3-1 |
None known |
onevpl-intel-gpuDebian:13 |
before 24.3.3-1 | 24.3.3-1 |
onevpl-intel-gpuDebian:14 |
before 24.3.3-1 | 24.3.3-1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 1.16.3-150200.4.22.1 | 1.16.3-150200.4.22.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 1.16.3-150200.4.22.1 | 1.16.3-150200.4.22.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 1.16.3-150200.4.22.1 | 1.16.3-150200.4.22.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 1.22.0-150500.3.25.2 | 1.22.0-150500.3.25.2 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 1.22.0-150500.3.25.2 | 1.22.0-150500.3.25.2 |
libvplSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 2023.0.0-150500.3.2.1 | 2023.0.0-150500.3.2.1 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libvplSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 |
before 2023.0.0-150500.3.2.1 | 2023.0.0-150500.3.2.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 1.22.0-150500.3.25.2 | 1.22.0-150500.3.25.2 |
libvplopenSUSE:Leap 15.5 |
before 2023.0.0-150500.3.2.1 | 2023.0.0-150500.3.2.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
gstreamer-plugins-badSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
gstreamer-plugins-badSUSE:Manager Proxy 4.3 |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
gstreamer-plugins-badSUSE:Manager Server 4.3 |
before 1.20.1-150400.3.23.2 | 1.20.1-150400.3.23.2 |
libmfxSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 19.1.0-3.3.1 | 19.1.0-3.3.1 |
libmfxSUSE:Linux Enterprise Server 12 SP5 |
before 19.1.0-3.3.1 | 19.1.0-3.3.1 |
libmfxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 19.1.0-3.3.1 | 19.1.0-3.3.1 |
libmfxSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 22.6.1-150500.3.5.1 | 22.6.1-150500.3.5.1 |
libmfxSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 22.6.1-150500.3.5.1 | 22.6.1-150500.3.5.1 |
libmfxopenSUSE:Leap 15.5 |
before 22.6.1-150500.3.5.1 | 22.6.1-150500.3.5.1 |
ffmpeg-4SUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4SUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4SUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4SUSE:Linux Enterprise Workstation Extension 15 SP5 |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
ffmpeg-4openSUSE:Leap 15.5 |
before 4.4-150400.3.42.1 | 4.4-150400.3.42.1 |
libmfxSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 21.3.4-150400.3.5.1 | 21.3.4-150400.3.5.1 |
libmfxSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 21.3.4-150400.3.5.1 | 21.3.4-150400.3.5.1 |
libmfxSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 21.3.4-150400.3.5.1 | 21.3.4-150400.3.5.1 |
libmfxSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 21.3.4-150400.3.5.1 | 21.3.4-150400.3.5.1 |
intel-mediasdkUbuntu:20.04:LTS |
All versions, plus listed versions 19.2.1-119.4.0-119.4.0-1build120.1.0-0ubuntu1 |
None known |
intel-mediasdkUbuntu:22.04:LTS |
All versions, plus listed versions 21.1.0-121.3.4-122.1.0-122.3.0-1 |
None known |
onevplUbuntu:22.04:LTS |
All versions, plus listed versions 2022.0.4-12022.1.0-2 |
None known |
intel-mediasdkUbuntu:24.04:LTS |
All versions, plus listed versions 22.5.4-1 |
None known |
onevplUbuntu:24.04:LTS |
All versions, plus listed versions 2023.3.0-12023.3.0-1build1 |
None known |
ffmpeg-4openSUSE:Tumbleweed |
before 4.4.5-9.1 | 4.4.5-9.1 |
ffmpeg-7openSUSE:Tumbleweed |
before 7.1.1-1.1 | 7.1.1-1.1 |
ffmpeg-6openSUSE:Tumbleweed |
before 6.1.2-3.1 | 6.1.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22656 is a low vulnerability (CVSS 3.9) in Intel Media Sdk, published May 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in onevpl-intel-gpu 24.3.3-1.
References
intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html
nvd.nist.gov/vuln/detail/CVE-2023-22656
github.com/advisories/GHSA-9xh8-4cjj-qf63
security-tracker.debian.org/tracker/CVE-2023-22656
suse.com/support/update/announcement/2024/suse-su-20243198-1
bugzilla.suse.com/1219494
Show 58 moreShow less
ubuntu.com/security/CVE-2023-22656
cve.org/CVERecord?id=CVE-2023-22656
lists.opensuse.org/archives/list/[email protected]/thread/GBGGBDABKAXEMYS3ELQOOTZKY5CRNTCF