libx264 Memory Leak Vulnerability Allowing Arbitrary Code Execution

A vulnerability in libx264 git master has been identified, stemming from inadequate management of allocated memory. This flaw can be exploited by creating a specially crafted AAC file, leading to arbitrary code execution. The issue arises when libx264 is used with FFmpeg, specifically with the 'libx264' and 'gpl' options enabled. The vulnerability has been confirmed to be a memory leak, where duplicated strings are not properly freed, allowing for potential exploitation.

Impact

The vulnerability allows for arbitrary code execution by exploiting the memory leak issue, which could be leveraged to execute malicious code under certain conditions.

Reproduction

The vulnerability can be reproduced by compiling FFmpeg with the 'libx264' and 'gpl' options enabled, using Clang as the compiler. After compiling FFmpeg, the memory leak can be observed using Valgrind, which will report the leaked bytes as a direct indication of the memory leak issue.

Remediation

Users can avoid this vulnerability by not enabling the 'libx264' and 'gpl' options when using FFmpeg. Additionally, they can monitor for future releases of libx264 that address this memory leak issue.