CVE-2022-3965 ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds

2022-11-1300:00:00

CWE-119

VulDB

www.cve.org

cve-2022-3965

ffmpeg

quicktime graphics video encoder

vulnerability

out-of-bounds

remote attack

patch

vdb-213544

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

59.0%

JSON

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

CNA Affected

[
  {
    "vendor": "unspecified",
    "product": "ffmpeg",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]