CVE-2023-45221 is a medium severity improper buffer restriction flaw in Intel Media SDK, scored 4.8 in NVD. A local authenticated user may be able to escalate privileges. Intel has discontinued the SDK and recommends that users uninstall it and move to oneVPL.
What's affected
Per the NVD record and Intel's advisory SA-00935, all versions of Intel Media SDK are affected by this CVE. There is no fixed Media SDK release, because Intel discontinued the product.
The advisory covers several related CVEs. For other issues in the same bulletin, oneVPL before 23.3.5 is affected and 23.3.5 or later is the fix. That version figure applies to those other CVEs, not to CVE-2023-45221, which the advisory lists against Media SDK only.
The record and the advisory agree on the score: 4.8, medium, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. The attack is local, needs some privileges, and needs a user to take part.
How to check if you're exposed
Media SDK is a development kit for video encode, decode and processing on Intel hardware. It can show up on a build machine, inside a media application, or bundled with a product that you ship.
Start with your own code. Search repositories and build scripts for references to the Media SDK libraries and headers:
grep -ril "mfxvideo\|media_sdk\|intel media sdk" .
Then check installed software on workstations and build agents by name. If a vendor product bundles the SDK, ask the vendor which build includes a supported replacement.
What to do now
- Find where Media SDK is installed or linked, on developer machines, build agents and shipped applications.
- Plan the move to Intel oneVPL, which Intel names as the replacement in its upgrade guidance.
- Uninstall Media SDK from machines that no longer need it.
- For products you ship, record the SDK as a known end of life component with a replacement date.
- Rescan after the move to confirm the old SDK no longer appears in your inventory.
Why it matters
The weakness is a classic memory safety class, CWE-119: operations on a memory buffer that read or write outside its intended bounds. Bugs of this type in native media code can lead to crashes or to code running with the rights of the affected process. Here the score is held down by the need for local access and user interaction.
The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation. The bigger lesson is the lifecycle one. A component that its vendor has discontinued will not get a fix for the next bug either, so inventory work should flag end of life dependencies before the CVE arrives.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
The record also lists CWE-119 for this CVE.
Quick check
What replaces Intel Media SDK?
Intel's advisory points users to oneVPL and to its upgrade guide. Check Intel's guidance for the migration steps.
Is every Media SDK version affected?
Yes for this CVE, according to both the record and the Intel advisory.
Sources
Last reviewed: 19 October 2026.
