Search for vulnerabilities
Vulnerability details: VCID-q6hd-xazy-aaaj
Vulnerability ID VCID-q6hd-xazy-aaaj
Aliases CVE-2022-41741
Summary NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
generic_textual medium http://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41741.json
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.0054 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.0054 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.0054 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00556 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00556 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.00996 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01024 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01144 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01144 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01144 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.01144 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
epss 0.12536 https://api.first.org/data/v1/epss?cve=CVE-2022-41741
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7 https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
ssvc Track https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
cvssv3.1 7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
cvssv3.1 7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
cvssv3.1 7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
generic_textual medium https://mailman.nginx.org/archives/list/nginx-announce@nginx.org/message/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA/
generic_textual medium https://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2022-41741
cvssv3.1 7.8 https://nvd.nist.gov/vuln/detail/CVE-2022-41741
cvssv3.1 7 https://security.netapp.com/advisory/ntap-20230120-0005/
ssvc Track https://security.netapp.com/advisory/ntap-20230120-0005/
cvssv3.1 7 https://support.f5.com/csp/article/K81926432
ssvc Track https://support.f5.com/csp/article/K81926432
cvssv3.1 7 https://www.debian.org/security/2022/dsa-5281
ssvc Track https://www.debian.org/security/2022/dsa-5281
Reference id Reference type URL
http://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41741.json
https://api.first.org/data/v1/epss?cve=CVE-2022-41741
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41741
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41742
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
https://mailman.nginx.org/archives/list/nginx-announce@nginx.org/message/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA/
https://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html
https://nginx.org/download/patch.2022.mp4.txt
https://nginx.org/download/patch.2022.mp4.txt.asc
https://security.netapp.com/advisory/ntap-20230120-0005/
https://support.f5.com/csp/article/K81926432
https://www.debian.org/security/2022/dsa-5281
2141495 https://bugzilla.redhat.com/show_bug.cgi?id=2141495
cpe:2.3:a:f5:nginx:1.23.0:*:*:*:open_source:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:1.23.0:*:*:*:open_source:*:*:*
cpe:2.3:a:f5:nginx:1.23.1:*:*:*:open_source:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:1.23.1:*:*:*:open_source:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx:*:*:*:*:open_source:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:*:*:*:*:open_source:*:*:*
cpe:2.3:a:f5:nginx:*:*:*:*:plus:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:*:*:*:*:plus:*:*:*
cpe:2.3:a:f5:nginx:r1:*:*:*:open_source_subscription:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:r1:*:*:*:open_source_subscription:*:*:*
cpe:2.3:a:f5:nginx:r2:*:*:*:open_source_subscription:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:f5:nginx:r2:*:*:*:open_source_subscription:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
CVE-2022-41741 https://nvd.nist.gov/vuln/detail/CVE-2022-41741
RHSA-2025:7402 https://access.redhat.com/errata/RHSA-2025:7402
RHSA-2025:7546 https://access.redhat.com/errata/RHSA-2025:7546
RHSA-2025:7619 https://access.redhat.com/errata/RHSA-2025:7619
USN-5722-1 https://usn.ubuntu.com/5722-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41741.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-41741
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-41741
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230120-0005/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://security.netapp.com/advisory/ntap-20230120-0005/
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://support.f5.com/csp/article/K81926432
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://support.f5.com/csp/article/K81926432
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2022/dsa-5281
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-05-08T18:12:04Z/ Found at https://www.debian.org/security/2022/dsa-5281
Exploit Prediction Scoring System (EPSS)
Percentile 0.05128
EPSS Score 0.00042
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.