Search for vulnerabilities
Vulnerability details: VCID-hzzt-4dkj-cyg5
Vulnerability ID VCID-hzzt-4dkj-cyg5
Aliases CVE-2022-3341
Summary A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2022-3341
cvssv3.1 5.3 https://bugzilla.redhat.com/show_bug.cgi?id=2157054
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2157054
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e
ssvc Track https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2022-3341
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-3341
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3109
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3341
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
9cf652cef49d74afe3d454f27d49eb1a1394951e https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2022-3341 https://nvd.nist.gov/vuln/detail/CVE-2022-3341
msg00016.html https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
show_bug.cgi?id=2157054 https://bugzilla.redhat.com/show_bug.cgi?id=2157054
USN-5958-1 https://usn.ubuntu.com/5958-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2157054
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-08T15:56:11Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2157054
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-08T15:56:11Z/ Found at https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-08T15:56:11Z/ Found at https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2022-3341
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11003
EPSS Score 0.0004
Published At Aug. 3, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:36:49.077118+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/5958-1/ 37.0.0