-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, a heap use-after-free, is explicitly stated in the CVE description and commit message to occur via the av_hwframe_ctx_init function in libavutil/hwcontext.c. The provided commit patch directly modifies this function. The changes involve removing goto fail; statements and the corresponding fail: block, which contained a call to ctx->internal->hw_type->frames_uninit(ctx). This call, when made after certain initialization functions (e.g., vulkan_frames_init, as mentioned in the commit message) failed, would lead to the use-after-free. Therefore, av_hwframe_ctx_init is the function that contained the vulnerable logic that incorrectly invoked frames_uninit under specific failure conditions, making it the primary vulnerable function. The patch directly addresses this flawed logic within av_hwframe_ctx_init.