Every CVE Search/ Get API key

CVE-2023-39929

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may...

6.7 MediumFix available

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.24%Up 0.2 points since May 17, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.7

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
CVE-2023-39929
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
EUVDEUVD-2023-43627 6.7

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
EUVD-2023-43627
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4jmf-2ggr-ph9x 6.7

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may...

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
GHSA-4jmf-2ggr-ph9x
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
NVD 6.7

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
CVE-2023-39929
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
OSVOESA-2024-1689 6.7

libva security update

Libva is an implementation for VA-API, which is an open-source library and API specification, provides access to graphics hardware acceleration capabilities for video processing. It consists of a main library and driver-specific acceleration backends for each supported hardware vendor.

Security Fix(es):

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2023-39929)

Record
OESA-2024-1689
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-39929 6.7

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
UBUNTU-CVE-2023-39929
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVAZL-48840 No score

CVE-2023-39929 affecting package libva 2.11.0-143

Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Record
AZL-48840
Updated
2026-11-02
OSVSUSE-SU-2025:1451-1 No score

Security update for libva

This update for libva fixes the following issues:

Update to libva version 2.20.0, which includes security fix for:

  • uncontrolled search path may allow an authenticated user to escalate privilege via local access (CVE-2023-39929, bsc#1224413, jsc#PED-11066)

This includes latest version of one of the components needed for Video (processing) hardware support on Intel GPUs (bsc#1217770)

Update to version 2.20.0:

  • av1: Revise offsets comments for av1 encode
  • drm:
    • Limit the array size to avoid out of range
    • Remove no longer used helpers
  • jpeg: add support for crop and partial decode
  • trace:
    • Add trace for vaExportSurfaceHandle
    • Unlock mutex before return
    • Fix minor issue about printf data type and value range
  • va/backend:
    • Annotate vafool as deprecated
    • Document the vaGetDriver* APIs
  • va/x11/va_fglrx: Remove some dead code
  • va/x11/va_nvctrl: Remove some dead code
  • va:
    • Add new VADecodeErrorType to indicate the reset happended in the driver
    • Add vendor string on va_TraceInitialize
    • Added Q416 fourcc (three-plane 16-bit YUV 4:4:4)
    • Drop no longer applicable vaGetDriverNames check
    • Fix:don't leak driver names, when override is set
    • Fix:set driver number to be zero if vaGetDriverNames failed
    • Optimize code of getting driver name for all protocols/os (wayland,x11,drm,win32,android)
    • Remove legacy code paths
    • Remove unreachable 'DRIVER BUG'
  • win32:
    • Only print win32 driver messages in DEBUG builds
    • Remove duplicate adapter_luid entry
  • x11/dri2: limit the array handling to avoid out of range access
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLE env var
    • Implement vaGetDriverNames
    • Remove legacy code paths

Update to 2.19.0:

  • add: Add mono_chrome to VAEncSequenceParameterBufferAV1
  • add: Enable support for license acquisition of multiple protected playbacks
  • fix: use secure_getenv instead of getenv
  • trace: Improve and add VA trace log for AV1 encode
  • trace: Unify va log message, replace va_TracePrint with va_TraceMsg.

Update to version 2.18.0:

  • doc: Add build and install libva informatio in home page.
  • fix:
    • Add libva.def into distribution package
    • NULL check before calling strncmp.
    • Remove reference to non-existent symbol
  • meson: docs:
    • Add encoder interface for av1
    • Use libva_version over project_version()
  • va:
    • Add VAProfileH264High10
    • Always build with va-messaging API
    • Fix the codying style of CHECK_DISPLAY
    • Remove Android pre Jelly Bean workarounds
    • Remove dummy isValid() hook
    • Remove unused drm_sarea.h include & ANDROID references in va_dricommon.h
    • va/sysdeps.h: remove Android section
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLe env var
    • Use LIBVA_DRI3_DISABLE in GetNumCandidates

Update to 2.17.0:

  • win: Simplify signature for driver name loading
  • win: Rewrite driver registry query and fix some bugs/leaks/inefficiencies
  • win: Add missing null check after calloc
  • va: Update security disclaimer
  • dep:remove the file .cvsignore
  • pkgconfig: add 'with-legacy' for emgd, nvctrl and fglrx
  • meson: add 'with-legacy' for emgd, nvctrl and fglrx
  • x11: move all FGLRX code to va_fglrx.c
  • x11: move all NVCTRL code to va_nvctrl.c
  • meson: stop using deprecated meson.source_root()
  • meson: stop using configure_file copy=true
  • va: correctly include the win32 (local) headers
  • win: clean-up the coding style
  • va: dos2unix all the files
  • drm: remove unnecessary dri2 version/extension query
  • trace: annotate internal functions with DLL_HIDDEN
  • build/sysdeps: Remove HAVE_GNUC_VISIBILITY_ATTRIBUTE and use GNUC support level attribute instead
  • meson: Check support for -Wl,-version-script and build link_args accordingly
  • meson: Set va_win32 soversion to '' and remove the install_data rename
  • fix: resouce check…
Record
SUSE-SU-2025:1451-1
Updated
2026-11-02
OSVSUSE-SU-2025:1452-1 No score

Security update for libva

This update for libva fixes the following issues:

Update to libva version 2.20.0, which includes security fix for:

  • CVE-2023-39929: Uncontrolled search path may allow an authenticated user to escalate privilege via local access (bsc#1224413, jsc#PED-11066)

This includes latest version of one of the components needed for Video (processing) hardware support on Intel GPUs (bsc#1217770)

Update to version 2.20.0:

  • av1: Revise offsets comments for av1 encode
  • drm:
    • Limit the array size to avoid out of range
    • Remove no longer used helpers
  • jpeg: add support for crop and partial decode
  • trace:
    • Add trace for vaExportSurfaceHandle
    • Unlock mutex before return
    • Fix minor issue about printf data type and value range
  • va/backend:
    • Annotate vafool as deprecated
    • Document the vaGetDriver* APIs
  • va/x11/va_fglrx: Remove some dead code
  • va/x11/va_nvctrl: Remove some dead code
  • va:
    • Add new VADecodeErrorType to indicate the reset happended in the driver
    • Add vendor string on va_TraceInitialize
    • Added Q416 fourcc (three-plane 16-bit YUV 4:4:4)
    • Drop no longer applicable vaGetDriverNames check
    • Fix:don't leak driver names, when override is set
    • Fix:set driver number to be zero if vaGetDriverNames failed
    • Optimize code of getting driver name for all protocols/os (wayland,x11,drm,win32,android)
    • Remove legacy code paths
    • Remove unreachable 'DRIVER BUG'
  • win32:
    • Only print win32 driver messages in DEBUG builds
    • Remove duplicate adapter_luid entry
  • x11/dri2: limit the array handling to avoid out of range access
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLE env var
    • Implement vaGetDriverNames
    • Remove legacy code paths

Update to 2.19.0:

  • add: Add mono_chrome to VAEncSequenceParameterBufferAV1
  • add: Enable support for license acquisition of multiple protected playbacks
  • fix: use secure_getenv instead of getenv
  • trace: Improve and add VA trace log for AV1 encode
  • trace: Unify va log message, replace va_TracePrint with va_TraceMsg.

Update to version 2.18.0:

  • doc: Add build and install libva informatio in home page.
  • fix:
    • Add libva.def into distribution package
    • NULL check before calling strncmp.
    • Remove reference to non-existent symbol
  • meson: docs:
    • Add encoder interface for av1
    • Use libva_version over project_version()
  • va:
    • Add VAProfileH264High10
    • Always build with va-messaging API
    • Fix the codying style of CHECK_DISPLAY
    • Remove Android pre Jelly Bean workarounds
    • Remove dummy isValid() hook
    • Remove unused drm_sarea.h include & ANDROID references in va_dricommon.h
    • va/sysdeps.h: remove Android section
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLe env var
    • Use LIBVA_DRI3_DISABLE in GetNumCandidates

update to 2.17.0:

  • win: Simplify signature for driver name loading
  • win: Rewrite driver registry query and fix some bugs/leaks/inefficiencies
  • win: Add missing null check after calloc
  • va: Update security disclaimer
  • dep:remove the file .cvsignore
  • pkgconfig: add 'with-legacy' for emgd, nvctrl and fglrx
  • meson: add 'with-legacy' for emgd, nvctrl and fglrx
  • x11: move all FGLRX code to va_fglrx.c
  • x11: move all NVCTRL code to va_nvctrl.c
  • meson: stop using deprecated meson.source_root()
  • meson: stop using configure_file copy=true
  • va: correctly include the win32 (local) headers
  • win: clean-up the coding style
  • va: dos2unix all the files
  • drm: remove unnecessary dri2 version/extension query
  • trace: annotate internal functions with DLL_HIDDEN
  • build/sysdeps: Remove HAVE_GNUC_VISIBILITY_ATTRIBUTE and use GNUC support level attribute instead
  • meson: Check support for -Wl,-version-script and build link_args accordingly
  • meson: Set va_win32 soversion to '' and remove the install_data rename
  • fix: resouce check…
Record
SUSE-SU-2025:1452-1
Updated
2026-11-02
OSVSUSE-SU-2025:1453-1 No score

Security update for libva

This update for libva fixes the following issues:

Update to libva version 2.20.0, which includes security fix for:

  • CVE-2023-39929: uncontrolled search path may allow an authenticated user to escalate privilege via local access (bsc#1224413, jsc#PED-11066)

This includes latest version of one of the components needed for Video (processing) hardware support on Intel GPUs (bsc#1217770)

Update to version 2.20.0:

  • av1: Revise offsets comments for av1 encode

  • drm:

    • Limit the array size to avoid out of range
    • Remove no longer used helpers

  • jpeg: add support for crop and partial decode

  • trace:

    • Add trace for vaExportSurfaceHandle
    • Unlock mutex before return
    • Fix minor issue about printf data type and value range

  • va/backend:

    • Annotate vafool as deprecated
    • Document the vaGetDriver* APIs

  • va/x11/va_fglrx: Remove some dead code

  • va/x11/va_nvctrl: Remove some dead code

  • va:

    • Add new VADecodeErrorType to indicate the reset happended in the driver
    • Add vendor string on va_TraceInitialize
    • Added Q416 fourcc (three-plane 16-bit YUV 4:4:4)
    • Drop no longer applicable vaGetDriverNames check
    • Fix:don't leak driver names, when override is set
    • Fix:set driver number to be zero if vaGetDriverNames failed
    • Optimize code of getting driver name for all protocols/os (wayland,x11,drm,win32,android)
    • Remove legacy code paths
    • Remove unreachable 'DRIVER BUG'

  • x11/dri2: limit the array handling to avoid out of range access

  • x11:

    • Allow disabling DRI3 via LIBVA_DRI3_DISABLE env var
    • Implement vaGetDriverNames
    • Remove legacy code paths

Update to 2.19.0:

  • add: Add mono_chrome to VAEncSequenceParameterBufferAV1
  • add: Enable support for license acquisition of multiple protected playbacks
  • fix: use secure_getenv instead of getenv
  • trace: Improve and add VA trace log for AV1 encode
  • trace: Unify va log message, replace va_TracePrint with va_TraceMsg.

Update to version 2.18.0:

  • doc: Add build and install libva informatio in home page.

  • fix:

    • Add libva.def into distribution package
    • NULL check before calling strncmp.
    • Remove reference to non-existent symbol

  • meson: docs:

    • Add encoder interface for av1
    • Use libva_version over project_version()

  • va:

    • Add VAProfileH264High10
    • Always build with va-messaging API
    • Fix the codying style of CHECK_DISPLAY
    • Remove Android pre Jelly Bean workarounds
    • Remove dummy isValid() hook
    • Remove unused drm_sarea.h include & ANDROID references in va_dricommon.h
    • va/sysdeps.h: remove Android section

  • x11:

    • Allow disabling DRI3 via LIBVA_DRI3_DISABLe env var

    • Use LIBVA_DRI3_DISABLE in GetNumCandidates

  • Add libva-wayland to baselibs.conf, now that its build have moved to the main part of spec, source validator should no longer complain on SLE.

Update to 2.17.0:

  • win: Simplify signature for driver name loading
  • win: Rewrite driver registry query and fix some bugs/leaks/inefficiencies
  • win: Add missing null check after calloc
  • va: Update security disclaimer
  • dep:remove the file .cvsignore
  • pkgconfig: add 'with-legacy' for emgd, nvctrl and fglrx
  • meson: add 'with-legacy' for emgd, nvctrl and fglrx
  • x11: move all FGLRX code to va_fglrx.c
  • x11: move all NVCTRL code to va_nvctrl.c
  • meson: stop using deprecated meson.source_root()
  • meson: stop using configure_file copy=true
  • va: correctly include the win32 (local) headers
  • win: clean-up the coding style
  • va: dos2unix all the files
  • drm: remove unnecessary dri2 version/extension query
  • trace: annotate internal functions with DLL_HIDDEN
  • build/sysdeps: Remove HAVE_GNUC_VISIBILITY_ATTRIBUTE and use GNUC support level attribute instead
  • meson: Check support for -Wl,-version-script and build link_args accordingly
  • meson: Set va_win32 soversion to '' and…
Record
SUSE-SU-2025:1453-1
Updated
2026-11-02
OSVSUSE-SU-2025:1477-1 No score

Security update for libva

This update for libva fixes the following issues:

Update to libva version 2.20.0, which includes security fix for:

  • uncontrolled search path may allow an authenticated user to escalate privilege via local access (CVE-2023-39929, bsc#1224413, jsc#PED-11066)

This includes latest version of one of the components needed for Video (processing) hardware support on Intel GPUs (bsc#1217770)

Update to version 2.20.0:

  • av1: Revise offsets comments for av1 encode
  • drm:
    • Limit the array size to avoid out of range
    • Remove no longer used helpers
  • jpeg: add support for crop and partial decode
  • trace:
    • Add trace for vaExportSurfaceHandle
    • Unlock mutex before return
    • Fix minor issue about printf data type and value range
  • va/backend:
    • Annotate vafool as deprecated
    • Document the vaGetDriver* APIs
  • va/x11/va_fglrx: Remove some dead code
  • va/x11/va_nvctrl: Remove some dead code
  • va:
    • Add new VADecodeErrorType to indicate the reset happended in the driver
    • Add vendor string on va_TraceInitialize
    • Added Q416 fourcc (three-plane 16-bit YUV 4:4:4)
    • Drop no longer applicable vaGetDriverNames check
    • Fix:don't leak driver names, when override is set
    • Fix:set driver number to be zero if vaGetDriverNames failed
    • Optimize code of getting driver name for all protocols/os (wayland,x11,drm,win32,android)
    • Remove legacy code paths
    • Remove unreachable 'DRIVER BUG'
  • win32:
    • Only print win32 driver messages in DEBUG builds
    • Remove duplicate adapter_luid entry
  • x11/dri2: limit the array handling to avoid out of range access
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLE env var
    • Implement vaGetDriverNames
    • Remove legacy code paths

Update to 2.19.0:

  • add: Add mono_chrome to VAEncSequenceParameterBufferAV1
  • add: Enable support for license acquisition of multiple protected playbacks
  • fix: use secure_getenv instead of getenv
  • trace: Improve and add VA trace log for AV1 encode
  • trace: Unify va log message, replace va_TracePrint with va_TraceMsg.

Update to version 2.18.0:

  • doc: Add build and install libva informatio in home page.
  • fix:
    • Add libva.def into distribution package
    • NULL check before calling strncmp.
    • Remove reference to non-existent symbol
  • meson: docs:
    • Add encoder interface for av1
    • Use libva_version over project_version()
  • va:
    • Add VAProfileH264High10
    • Always build with va-messaging API
    • Fix the codying style of CHECK_DISPLAY
    • Remove Android pre Jelly Bean workarounds
    • Remove dummy isValid() hook
    • Remove unused drm_sarea.h include & ANDROID references in va_dricommon.h
    • va/sysdeps.h: remove Android section
  • x11:
    • Allow disabling DRI3 via LIBVA_DRI3_DISABLe env var
    • Use LIBVA_DRI3_DISABLE in GetNumCandidates

Update to 2.17.0:

  • win: Simplify signature for driver name loading
  • win: Rewrite driver registry query and fix some bugs/leaks/inefficiencies
  • win: Add missing null check after calloc
  • va: Update security disclaimer
  • dep:remove the file .cvsignore
  • pkgconfig: add 'with-legacy' for emgd, nvctrl and fglrx
  • meson: add 'with-legacy' for emgd, nvctrl and fglrx
  • x11: move all FGLRX code to va_fglrx.c
  • x11: move all NVCTRL code to va_nvctrl.c
  • meson: stop using deprecated meson.source_root()
  • meson: stop using configure_file copy=true
  • va: correctly include the win32 (local) headers
  • win: clean-up the coding style
  • va: dos2unix all the files
  • drm: remove unnecessary dri2 version/extension query
  • trace: annotate internal functions with DLL_HIDDEN
  • build/sysdeps: Remove HAVE_GNUC_VISIBILITY_ATTRIBUTE and use GNUC support level attribute instead
  • meson: Check support for -Wl,-version-script and build link_args accordingly
  • meson: Set va_win32 soversion to '' and remove the install_data rename
  • fix: resouce check…
Record
SUSE-SU-2025:1477-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libva
Azure Linux:2
 through 2.11.0-143 None known
libva
openEuler:20.03-LTS-SP4
 before 2.20.0-1.oe2003sp4
2.20.0-1.oe2003sp4
libva
openEuler:22.03-LTS-SP1
 before 2.20.0-1.oe2203sp1
2.20.0-1.oe2203sp1
libva
openEuler:22.03-LTS-SP3
 before 2.20.0-1.oe2203sp3
2.20.0-1.oe2203sp3
libva
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 2.20.0-150300.3.3.1
2.20.0-150300.3.3.1
libva
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 2.20.0-150300.3.3.1
2.20.0-150300.3.3.1
libva
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 2.20.0-150300.3.3.1
2.20.0-150300.3.3.1
libva
SUSE:Enterprise Storage 7.1
 before 2.20.0-150300.3.3.1
2.20.0-150300.3.3.1
libva
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.20.0-150400.3.5.1
2.20.0-150400.3.5.1
libva
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.20.0-150400.3.5.1
2.20.0-150400.3.5.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
libva
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.20.0-150400.3.5.1
2.20.0-150400.3.5.1
libva
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.20.0-150400.3.5.1
2.20.0-150400.3.5.1
libva
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.20.0-150500.3.5.1
2.20.0-150500.3.5.1
libva
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.20.0-150500.3.5.1
2.20.0-150500.3.5.1
libva
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.20.0-150500.3.5.1
2.20.0-150500.3.5.1
libva
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.20.0-150500.3.5.1
2.20.0-150500.3.5.1
libva
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.20.0-3.3.4
2.20.0-3.3.4
libva
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.20.0-3.3.4
2.20.0-3.3.4
libva
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.1.1-31.2.1-21.3.0-2
 None known
libva
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6.0-11.6.1-11.6.2-11.6.2-21.7.0-11.7.0-1ubuntu0.1
 None known
libva
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-22.0.0-22.1.0-12.1.0-3
 None known
libva
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.5.0-12.5.0-22.6.0-12.6.1-12.7.0-12.7.0-2
 None known
libva
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.0-22.13.0-12.14.0-1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39929 is a medium vulnerability (CVSS 6.7) in Intel Libva, published May 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in libva 2.20.0-1.oe2003sp4.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open