CVE-2020-19824
📋 TL;DR
This vulnerability in MPV media player allows attackers to execute arbitrary code and crash the program via the ao_c parameter. It affects users running MPV version 0.29.1 and earlier. The issue was fixed in version 0.30.
💻 Affected Systems
- MPV media player
📦 What is this software?
Mpv by Mpv
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited code execution in the context of the MPV process.
If Mitigated
No impact if patched or workarounds applied; isolated impact if sandboxed.
🎯 Exploit Status
Exploitation requires user to open a malicious media file; public proof-of-concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.30 and later
Vendor Advisory: https://github.com/mpv-player/mpv/issues/6808
Restart Required: Yes
Instructions:
1. Download MPV version 0.30 or later from official sources. 2. Uninstall old version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Disable audio output via ao_c
allPrevent exploitation by disabling the vulnerable audio output parameter.
mpv --ao=null input_file
Use sandboxing
linuxRun MPV in a restricted environment to limit impact.
firejail mpv input_file
🧯 If You Can't Patch
- Restrict user permissions to limit damage from code execution.
- Implement application whitelisting to prevent unauthorized MPV execution.
🔍 How to Verify
Check if Vulnerable:
Check MPV version: if version is 0.29.1 or earlier, system is vulnerable.Check Version:
mpv --version | head -1Verify Fix Applied:
Confirm MPV version is 0.30 or later after update.📡 Detection & Monitoring
Log Indicators:
- MPV crash logs with ao_c parameter references
- Unexpected process termination of mpv
Network Indicators:
- Downloads of suspicious media files triggering MPV
SIEM Query:
process_name="mpv" AND (event_id=1000 OR crash)