CVE-2023-45221: 
Ffmpeg vulnerability analysis and mitigation

Improper buffer restrictions in Intel(R) Media SDK all versions has been identified as a security vulnerability that allows authenticated users to potentially enable escalation of privilege through local access. This vulnerability, tracked as CVE-2023-45221, was disclosed on May 14, 2024, affecting all versions of Intel Media SDK software (Intel Advisory).

The vulnerability has been assigned a CVSS Base Score of 4.8 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating issues with memory buffer operations (NVD).

The vulnerability can lead to multiple security impacts including escalation of privilege, with potential for unauthorized access elevation when exploited. The attack requires local access and user interaction, with impacts affecting confidentiality, integrity, and availability, each rated as Low according to the CVSS metrics (Intel Advisory).

The vulnerability requires an authenticated user with local access to exploit. User interaction is required for successful exploitation, as indicated by the CVSS vector's UI:R component. The attack complexity is considered Low (AC:L), suggesting that the vulnerability is relatively straightforward to exploit once the necessary access conditions are met (Intel Advisory).

Intel has issued a Product Discontinuation notice for Intel® Media SDK software and recommends that users uninstall it or discontinue use at their earliest convenience. Users are encouraged to transition to Intel® oneVPL software as a long-term solution, following the transition guide provided by Intel (Intel Advisory).