CVE-2022-34568: libsdl simple_directmedia_layer Use After Free
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2022-34568USN-5586-1DEBIAN-CVE-2022-34568
Published 28-07-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-34568 is a high (CVSS 7.5) Use After Free vulnerability in libsdl simple_directmedia_layer. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.11%
0%100%
Low · +0.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-07-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.11%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
+0.06 pp
From 1.06% on 18-09-2026
18-09-202618-10-2026
EPSS score1.11%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSdl 1.2
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- libsdl1.2All versions (No fix recorded) | < 1.2.15+dfsg1-3ubuntu0.1+esm2
- libsdl2All versions (No fix recorded)
Debian1 product
- libsdl1.2< 1.2.15+dfsg2-8
Libsdl1 product
- simple_directmedia_layer≥ 1.2.1, ≤ 1.2.15
3 vendors · 4 products
References
6 links- security.gentoo.org/glsa/202305-17Vendor Advisory
